How to Connect to GT Eduroam with a Client Certificate

By Ken Shibata

Published on

This is a living document; content will be updated as necessary (after the initial post date).

Georgia Tech has been rolling out a new TLS client certificate-based (instead of a username and password) authentication method for eduroam.

As a supplement to the guide on ServiceNow, this page provides a walkthrough for NetworkManager, using nm-connection-editor.

Generate a Certificate using the SecureW2 JoinNow Advanced Portal

Note: This section is essentially the same as the ServiceNow page.

Get your Wi-Fi interface’s MAC address (or choose a random MAC address to use):

nmcli

You’ll get something like this:

wlp0s20f3: connected to eduroam (GT cert)
  "Intel Something Something"
  wifi (iwlwifi), AA:AA:AA:AA:AA:AA, hw, mtu 1234
  ip4 default
  inet4 1.2.3.4/23
  route4 1.2.3.4/23 metric 600
  route4 default via 1.2.3.4 metric 600
  inet6 fe80::/64
  route6 fe80::/64 metric 1024

lo: connected (externally) to lo
  "lo"
  loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536
  inet4 127.0.0.1/8
  inet6 ::1/128

DNS configuration:
  servers: 137.82.1.1 142.103.1.1 137.82.1.2 142.103.1.42
  domains: wireless.ubc.ca
  interface: wlp0s20f3

Use "nmcli device show" to get complete information about known devices and
"nmcli connection show" to get an overview on active connection profiles.

Consult nmcli(1) and nmcli-examples(7) manual pages for complete usage details.
  1. Open the SecureW2 JoinNow Advanced Portal. Note: make sure to enter the correct MAC address.
  2. Download the P12 file. (Make sure to keep the passphrase you used here.)
  3. Download the USERTrust RSA Certification Authority.

Setup NetworkManager

NameValue
SecurityWPA/WPA2 Enterprise
AuthenticationTLS
Identitygburdell3@gatech.edu
Domainlawn.gatech.edu
CA certificateusertrustrsaca [jdk].cer1
CA certificate passwordNone
User certificategburdell3@gatech.edu.p122
User certificate passwordNone
User private keygburdell3@gatech.edu.p122 (auto-filled when entering User certificate)
User key passwordpassphrase given in SecureW2 portal

Done!

  1. 1Downloaded in step 3.
  2. 2This is the PKCS 12 file you downloaded in step 2.