Supported Wi-Fi Configurations

ArborXR offers Wi-Fi configuration functionality where users can create and configure a library of Wi-Fi networks, then remotely deploy configurations to devices to remotely connect them to new networks. Below are details on the supported security types, certificates, and proxies.

Security 

  • Open 
    • Open (Unsecured)
      • This type has no further settings.
    • OWE (Opportunistic Wireless Encryption)
      • Only supported by devices that run Android 10 (or later) and are certified as "Wi-Fi Certified Enhanced Open".
      • This type has no further settings.
  • Personal 
    • WPA/WPA2
      • Technical name is PSK (Pre-Shared Key).
      • This is either WPA-Personal (WPA-PSK) or WPA2-Personal (WPA2-PSK).
      • Password: String 8 to 63 characters.
    • WPA3
      • Only supported by devices that run Android 10 (or later) and specifically advertise support for this.
      • Technical name is SAE.
      • Also called WPA3-Personal (WPA3-PSK).
      • Password: String of 1 to 63 characters.
  • Enterprise 
    • WPA/WPA2
      • Technical name is EAP.
      • This is either WPA-Enterprise or WPA2-Enterprise.
      • EAP Method, one of:
        • PEAP (Protected Extensible Authentication Protocol, also called "Protected EAP")
          • Phase2 Method, one of:
            • MSCHAPv2 (Microsoft's Challenge Handshake Authentication Protocol version 2)
              • Identity: String
              • Password: String
            • GTC (Generic Token Card)
              • Identity: String
              • Password: String
          • CA Certificate: X.509 certificate (see below section for details)
            • OCSP stapling: See below section for details.
            • Domain: String
          • Anonymous Identity: String
        • TLS (Transport Layer Security)
          • (Optional) User Certificate: X.509 certificate (see below section for details)
          • CA Certificate: X.509 certificate (see below section for details)
            • OCSP stapling: See below section for details.
            • Domain: String
          • Identity: String
        • TTLS (Tunneled Transport Layer Security)
          • Phase2 Method, one of:
            • PAP (Password Authentication Protocol)
            • MSCHAP (Microsoft's Challenge Handshake Authentication Protocol version 1)
            • MSCHAPv2 (Microsoft's Challenge Handshake Authentication Protocol version 2)
            • GTC (Generic Token Card)
          • CA Certificate: X.509 certificate (see below section for details)
            • OCSP stapling: See below section for details.
            • Domain: String
          • Identity: String
          • Anonymous Identity: String
          • Password: String
        • PWD (Password)
          • Identity: String
          • Password: String
    • WPA3-Enterprise
      • Only supported by devices that run Android 10 (or later) and specifically advertise support for this.
      • Technical name is EAP Suite-B.
      • Settings: Except for more supported authentication methods, this is the same as EAP-TLS. However, the user certificate is required.

Certificates

Some of the enterprise WPA3 (i.e. EAP) methods require the use of (CA or user) certificates.

Certificates must be an X.509 certificate in Base64-encoded DER format (i.e. PEM) representation of a certificate without header, footer and line breaks. More information can be found in RFC 7468.

Instead of specifying a CA certificate, the device's system certificates can be used.

OCSP (Online Certificate Status Protocol) Stapling

Some of the enterprise WPA3 (i.e. EAP) methods require the use of a CA certificate, and thus require setting whether (and how) to check the revocation status of the certificate.

  • Only supported by devices that run Android 11 (or later). This setting is ignored on devices running earlier version of Android.
  • Formally known as the "TLS Certificate Status Request" extension.
  • Enum, one of:
    • None (Don't staple)
    • Request Status (Try to staple, but don't require a response)
    • Require Status (Require a valid response)
    • Require All non-trusted status (Require a valid response for all non-trusted certificates in the server certificate chain)

Proxy

Only supported by devices that run Android 8.0 (or later). 

  • Static
    • Host name: String
    • Port number: Integer from 0 to 65535
    • (Optional) List of hosts to bypass: String list
      • Can include wildcards, e.g. *.example.com, *.google.com
  • PAC (Proxy Auto-Config)
    • URL that points to a "PAC file": The file contains a JavaScript function FindProxyForURL(url, host) to dynamically decide whether to connect via a particular proxy server, or directly


Have a suggestion or feature request? We'd love to hear!
Message ArborXR


Still need help? Contact Us Contact Us