I'm setting up WPA3-Enterprise Wi‑Fi with FreeRADIUS and LDAP for a company. The certificates and most of the configuration are working, but iPhones won't connect as expected. They appear to fall back to MD5 or PEAP instead of using the EAP-TTLS method I configured. The usual recommendation is to install an Apple mobile configuration profile, but management does not want employees to download one manually. Is there a practical way for iPhones to authenticate with their LDAP credentials without requiring a mobileconfig file, and what would be the most secure design for company-owned versus personal devices?
4 Answers
Without a profile, iOS generally supports PEAP with MSCHAPv2, but it does not provide the flexibility to select TTLS with PAP. TTLS/PAP is commonly the option that works with a straightforward LDAP bind, so that combination effectively requires a configuration profile. If your directory can provide NT hashes or another backend that supports MSCHAPv2 verification, you could configure FreeRADIUS for PEAP-MSCHAPv2 and let iPhones connect without a profile. Plain LDAP password verification alone usually cannot validate MSCHAPv2.
Unmanaged personal phones should not be placed on the production network. Put them on a separate guest SSID and VLAN with client isolation and restricted access, optionally using a captive portal if guest authentication is needed. If management insists on corporate access from personal iPhones, they need to accept the security and support consequences of requiring device enrollment or a managed work profile.
The MD5-looking behavior is probably a symptom of an EAP-method mismatch rather than FreeRADIUS randomly choosing the wrong setting. iOS cannot simply be told to use every inner method from the server side. Either configure a method that iOS supports without a profile, such as PEAP-MSCHAPv2 with a compatible identity backend, or deploy an Apple configuration profile and use TTLS/PAP or preferably EAP-TLS.
For company-owned iPhones, the better solution is certificate-based EAP-TLS. Enroll the devices in MDM and push both the client certificate and Wi‑Fi configuration automatically. That avoids password exposure, works cleanly with iOS, and gives you a way to revoke access when a device is lost or leaves the company. LDAP can remain useful for other services, but it is not an ideal foundation for secure corporate Wi‑Fi authentication.
Be careful with the no-profile approach: if users manually accept a certificate, they may also accept a certificate from a cloned or evil-twin access point and send their credentials to it. Certificate validation should be enforced rather than relying on users to tap Trust.