Dear forumer,
I would like to configure my WIFI to utilize cert based authentication. I doing google search but cannot find complete step by step guide. If you have past experience or guide, please share it here.
Hope you all can help.
Thanks in advance.
Your access points need to support that feature. It cannot be implemented on the firewall, so it's not really an OPNsense topic. The keyword you want to look for is 802.1x. You also need a RADIUS server. That part can probably be run on OPNsense.
E.g. this article:
https://oneuptime.com/blog/post/2026-03-20-802-1x-enterprise-wifi-radius/view
What you want to realize is called 802.1X wifi authentication. This requires an authenticator (= wifi access point) and an authentication server (= RADIUS or alike).
You wifi access point has the support this. The feature is also called "WAP2/3 enterprise" on APs.
As auth server you can install the FreeRADIUS plugin on OPNsense. Then you can add a certificate authority and issue the clients certificates from it and assign it in FreeRADIUS for the client verification.
Also
every Wi-Fi client must support WPA2/WPA3-Enterprise with EAP-TLS and carry its own certificate — otherwise it simply will not connect
Devices without that support (printers, TVs) need a separate WPA2-PSK SSID instead.