Wi-Fi Provisioning Toolkit (WiFiProvisioningToolkit)

Wi-Fi Provisioning Toolkit is the generalized successor of PasspointProvisioningTools and eduroamProvisioningTools.

Popular applications are OpenRoaming / Passpoint and eduroam.

This toolkit supports both Passpoint (Hotspot 2.0) and legacy WPA2/WPA3 Enterprise networks except for some target OSs.

eduroam向けの日本語の紹介文は → こちら

Note: This toolkit is mainly for Identity Providers (IdPs, telecom operators) participating in a Wi-Fi roaming system such as OpenRoaming and eduroam. No one can create new accounts available on an existing roaming system by using this toolkit alone. Anyway, it's possible for any individual to generate a Wi-Fi profile by embedding a Wi-Fi account issued by an operator.

Web-based provisioning

The following OSs support web-based provisioning, using Wi-Fi profile.

• Windows 11 - via ms-settings: URI scheme
• macOS - via .mobileconfig
• iOS / iPadOS - via .mobileconfig
• Android - via PPS MO (Passpoint only)

The following OSs accept Wi-Fi profile but some manual operation or an app is required for Wi-Fi configuration.

• Android - via .eap-config (WPA2 Enterprise)
• ChromeOS - via Open Network Configuration (ONC)

This toolkit supports EAP-TTLS and EAP-TLS only. Some OSs may not support EAP-TLS.

Features

• This toolkit helps operators develop their own Passpoint profile provisioning systems.
• The CGI scripts allow end users to download Wi-Fi profile and configure Wi-Fi without typing in ID/password or loading certificates.

Directory layout

• user: Website with user's login, i.e., with access control.
• ext: Open website where Windows Wi-Fi Settings can download the profile from.
• etc: Storage for configuration and certificate files. This directory must be set inaccessible from the internet.

Requirements

Some additional Perl modules are needed. Please try "perl -c <script>.cgi" for every script to see which modules are missing on the server.

The CGI scripts require execution handler, e.g. "AddHandler cgi-script .cgi .config" in case of Apache2 web server.

About WPA2/WPA3 compatibility

This toolkit supports WPA3. Even if you see WPA2 string in the profiles, it allows Apple and Microsoft devices to join either WPA2 and WPA3 networks.

Profile for Android (PPS MO) does not have such setting.

EAP-TLS support status

Supported OS

This toolkit supports EAP-TLS on the following operating systems.

• Android
• iOS/iPadOS
• macOS

Unfortunately, Windows does not support EAP-TLS setting through the ms-settings: URI scheme as of Oct. 2024.

• cf. Overview of Passpoint (Hotspot 2.0) in Windows

A workaround is as follows, but this is cumbersome.

1. Operator issues a Passpoint profile for the EAP-TTLS method and a client certificate in PKCS #12 format.
2. User configures the device through the web-based provisioning and loads the client certificate manually.
3. User changes the Wi-Fi setting to EAP-TLS mode from EAP-TTLS manually.

Note on Privacy Protection

EAP-TLS (RFC 5216) is not always so secure in terms of privacy. When TLS 1.2 or older is used, Access Network Providers can snoop into the contents of client certificates. This allows the providers to keep track of each user. An efficient and straightforward solution would be to use TLS 1.3.

When TLS 1.3 is not available on user devices, a compromised solution would be to use "EAP-TTLS with EAP-TLS as inner method". Client certificates are protected by the encrypted tunnel of EAP-TTLS. Some supplicants like wpa_supplicant and Windows support this configuration, but the ms-settings: URI scheme does not work as explained above.

References

Please see separate file References .