Skip to main content

 

Cisco Meraki Documentation

Access Manager - EAP-TLS Client Configuration (Windows, macOS and iOS)

This article provides instructions on configuring Windows 10, macOS, and iOS client devices for certificate-based authentication (EAP-TLS) and obtaining authorization (such as SGT, VLAN, Group Policy, etc.) based on Access Manager rules.

The instructions in this article are intended as a reference to assist organizations in understanding the network settings, which can be useful when configuring network settings through an MDM or Group Policy (GP) update.

Please refer to Securing Managed Endpoints - EAP-TLS with Entra ID Lookup to view instructions on how to configure Entra ID integration, wired/wireless networks and Access Manager rules. 

Download RADIUS CA Certificate From Access Manager

In EAP-TLS flow, both the Access Manager and the local RADIUS server on the MR (during fallback when Extended Local Auth is enabled) present their certificates, enabling the client to validate them before connecting. It is recommended to install the RADIUS CA certificate that signed both the Access Manager and the local RADIUS server certificates on your endpoints to ensure these certificates are trusted automatically, without requiring user intervention.

Follow the instructions below to download the RADIUS CA certificate from Access Manager and install it on the endpoint: 

  • Navigate to Access Manager > Configure > Certificates

    a.png
     
  • Click on Download RADIUS CA certificates

    b.png
     
  • This downloads multiple files - make sure your browser allows multiple file downloads.

Windows 10

  • Open the downloaded RADIUS certificate from previous step and click open again

    cert install.png
     

  • Click on Install Certificate 

    Screenshot 2025-03-22 at 9.37.51 AM.png
     

  • Click Next > Next > Finish to continue installing certificate successfully 

  • In windows, navigate to the Network and Sharing Center > click on Set up a new connection or network 


    2.png

 

  • Choose Manually connect to a wireless network and click Next

    3.png

     
  • Enter the Network name that exactly matches the SSID configured for this use case, and choose WPA2-Enterprise as the security type. Click Next.

    4.png
     
  • Your network is successfully created. Click on Change connection settings

    5.png

     
  • Click on Security > choose Microsoft: Smart Card or other certificate as the authentication method > click on Settings

    6.png

     
  • Make sure following selections are made:
     
    • Use a certificate on this computer is selected 
    • Use simple certificate selection is checked. In case of multiple certificates causing issues, it is recommended to uncheck this and specifically select the endpoint certificate for authentication on this SSID
    • Verify the server's identity by validating the certificate is checked
    • Connect to these servers: Enter eap.meraki.com and *.YOUR_ORG_ID.radius.meraki.direct (Eg. *.131313.radius.meraki.direct) to ensure the client only connects to Meraki's server and no other rogue device advertising an SSID. Your org ID can be found on the bottom of any dashboard page after you login. 
    • Trusted Root Certificate Authorities: Select your PKI's trusted root CA and Identity Trust Commercial Root CA 1 (Access Manager root installed in the previous step) 
    • Click Ok

      win-8.png

       
  • Click Ok again on the main properties window
     
  • The windows client is now successfully configured to connect to the wireless network using a certificate (EAP-TLS). 

macOS and iOS 

macOS

  • In macOS, open Keychain Access > Click on File > Import items > select the downloaded RADIUS CA certificate and click open 

    MAC-a.png

     
  • Find the installed certificate (IdenTrust Commercial Root CA 1) from the list and open it > select Always Trust and close the window 

    MAC-b.png

     
  • In macOS, open Apple Configurator application (you will need to download it from the App Store if you do not already have it) 
     
  • Click on File > New Profile 
     
  • Enter the Name and Identifier for the profile 

    1.png

     
  • Click on Certificates > Configure > Select downloaded RADIUS CA certificate and click open 


    2.1.png

    2.2.png

     
  • Click on + icon > Select Endpoint/User Certificate to be used for this authentication 

    Screenshot 2025-03-22 at 12.29.08 PM.png

     
  • Click on Wi-Fi and set the following values: 
     
    • Service Set Identifier (SSID): SSID that exactly matches the SSID configured for this use case
    • Security Type: WPA2/WPA3 Enterprise
    • Accepted EAP Types: TLS
    • Identity Certificate: Choose the endpoint/user certificate added in the previous step

      3.png
       

 

  • Click on Trust under Enterprise Settings and Set the following values 
    • Trusted Certificates: Choose the certificate that was added in Certificates tab - Identity Trust Commercial Root CA 1
    • Trusted Server Certificate Names: Add eap.meraki.com and *.YOUR_ORG_ID.radius.meraki.net to ensure the client only connects to Meraki's server and no other rogue device advertising an SSID. Your org ID can be found on the bottom of any dashboard page after you login. 

      4.1.png

       
  • Click File > Save
  • Open the saved profile - this action will download the profile
  • Navigate to Settings > Device Management > Double click on the profile > Install 

    MAC-TLS-a.png

    MAC-TLS-b.png

     
  • Click  Install 

    MAC-TLS-c.png
        

     
  • The macOS client is now successfully configured to connect to the wireless network using a certificate (EAP-TLS). 

 

iOS 

On iOS, follow the same steps from macOS section: 

  • Copy the downloaded RADIUS CA certificate to iPhone and click open 
     
  • Navigate to Settings > Profile downloaded
     
  • Click Install > Install again > Done

    IPHONE-1.PNG        IPHONE-2.PNG.      IPHONE - 3.PNG

     
  • Copy the Profile created on Apple Configurator in the macOS section to iPhone and click open 
     
  • Navigate to Settings > Profile downloaded 
     
  • Click Install > Install  > Done

    TLS-ip-1.jpg       IPHONE-6.PNG     tls-ip3.jpg

 

  • The iOS client is now successfully configured to connect to the wireless network using a certificate (EAP-TLS).