Cert Based WIFI Authentication

[nicholaswkc]

Dear forumer,
I would like to configure my WIFI to utilize cert based authentication. I doing google search but cannot find complete step by step guide. If you have past experience or guide, please share it here.

Hope you all can help.

Thanks in advance.

[Patrick M. Hausen]

Your access points need to support that feature. It cannot be implemented on the firewall, so it's not really an OPNsense topic. The keyword you want to look for is 802.1x. You also need a RADIUS server. That part can probably be run on OPNsense.

E.g. this article:

https://oneuptime.com/blog/post/2026-03-20-802-1x-enterprise-wifi-radius/view

[viragomann]

What you want to realize is called 802.1X wifi authentication. This requires an authenticator (= wifi access point) and an authentication server (= RADIUS or alike).

You wifi access point has the support this. The feature is also called "WAP2/3 enterprise" on APs.

As auth server you can install the FreeRADIUS plugin on OPNsense. Then you can add a certificate authority and issue the clients certificates from it and assign it in FreeRADIUS for the client verification.

[(MARLOO)]

Also

every Wi-Fi client must support WPA2/WPA3-Enterprise with EAP-TLS and carry its own certificate — otherwise it simply will not connect

Devices without that support (printers, TVs) need a separate WPA2-PSK SSID instead.

[nero355]

Devices without that support (printers, TVs) need a separate WPA2-PSK SSID instead.

They could use MAC Address Authentication, but that's considered very weak in general so maybe just avoid it completely :)


But I wonder...


If someone needs a HowTo/Tutorial to setup the whole thing : Is it a good idea at all to start using such a setup ?!
Because when things break you need to know how to fix it !!
And there is no HowTo/Tutorial for that... ;)