Trying to setup certificate based authentication on phones. After battling with using Windows CA and UPN and Microsoft coming changes feb 2025 using secure options we gave up using unique user certifcates and accepted using the same cert for all users.   But even after accepting that defeat I cant get Android to work. iPhones behave as expected and provides the correct value as identity/username when connecting and connect fine to the WiFi. Android phones however picks the value/number from the Common Name of the default Meraki SCEP-certificate called "SCEP" in the dropdown. Doesnt matter that you change to your own cert payload in the dropdown under "Identity Certificate"   Have a case open with Meraki support but cant seem to get them to agree on that this has to be a bug in the Meraki MDM interface? You can easily edit the saved SSID and change the identity field from the common name numbers to the username and connect fine to the wireless. It just seems that Meraki chooses the value from the wrong certificate. ... View more

I have the following prereqs   Microsoft NPS as RADIUS Cisco APs, not Meraki-manageble Phones managed by Meraki MDM   Want to enable EAP-TLS for cert based authentication for phones   It seems like Microsoft NPS can only map a certificate to a user with the information in the Subject Alternative Name. If you compare a certificate created on Microsofts CA from the standard user template it registers the SAN info under other names: User Principal Name.   Meraki MDM only allows email, uri and DNS as options for the Subject Alternative Name field. So the NPS forwards the request to the domain controller instead that doesnt understand which user it is. The information that is sent to the domain controller is in the format of:   X509N:<S>CN=user@contoso.com   You can make it work by using the AD-attribute altSecurityIdentities and specifying that the user has that email, or by using the name mappings feature and simply adding the certificate on the user. Seems like shouldnt be necessary though.   Anyone know of a way to either make Meraki MDM allow more options for the SAN-field or make the NPS not require the user information to be in the specific Prinical Name option? ... View more