Private key required to install a certificate- any way to get around this?

cnphilips

I am trying to download and install a certificate to use my workplace's wifi. I Download the file, go through Settings > Security > Encryption & credentials > Install a certificate > Wifi certificate and select the downloaded cert. This kicks me back a screen displaying a toast that reads "Private key required to install a certificate." and no matter what other methods I try, I always get the "Private key..." message. Other posts have said that graphene removed the option to bypass the CA Certificate validation but those posts are dated so I wanted to check here to see if anything has changed. Would be really nice to connect to my work's WiFi but I work for a university so it's not surprising that the security level of the cert is not great...... any help or advice is appreciated.

n3t_admin

cnphilips are we talking about WPA2/3 Enterprise cert? If so, then the usual way that has worked for me so far, is to select it in the setup page of the associated WLAN. In simple terms, don't install the cert, just select it on the setup page. That has worked for me before (eduroam user here).

cnphilips

n3t_admin To be honest with you I'm not entirely sure, I think it might actually be a larger issue with a setting or something because I'm unable to sign in to anything NU related, even through the NU website. I've double checked my netID credentials are accurate and I have no problem logging in on other devices (old phone, laptop, etc). I'm wondering if there's a setting somewhere that I opted for that is now blocking communication to NU's platforms? Is that even a thing?

n3t_admin

cnphilips In your case, especially if you're unsure about the whole process, I would just ask the helpdesk for help. GrapheneOS is just standard Android when it comes to these kinds of things, so the guys should be able to figure it out pretty easily.
As for possible bans - yes. You can get banned from too many failed attempts, if your organization configured that.

cnphilips

n3t_admin thanks again for the response. I went to IT and they said they don't support GrapheneOS and that even though its based on Android, it's its own OS. I'm wondering if there's a setting somewhere that I've enabled that is blocking communication with the university somehow since it's not only wifi but all microsoft applications (outlook, teams, etc on both web access and apps) and also every website that requires my university credentials. I've looked all through my settings (for the phone and for the browser) and haven't found anything that seems like the issue but that doesn't mean I didn't miss it I guess. I've also tried logging in using Vanadium browser and Brave, neither work and immediately display the error page.

n3t_admin

cnphilips well that's helpful :/ I guess you shouldn't have told them that you're running GrapheneOS, they might have not noticed and actually could have been helpful.
I am unsure what you mean by can't access Microsoft apps. Naturally, those will only be accessible through a single-sign-on in modern universities and thus require your login first, which seems to not work as well. At this point I'm wondering about the implementation they are using for that as well? Did they say how the process would normally go for a stock Android phone? It can't be much more complicated than installing a cert, if we're speaking from experience.

Lobo

are you concerned with anonymity? Private Key wont give you that in the workplace because your employer manages the key server.

cnphilips

I definitely regret mentioning GrapheneOS, but thought it would help them understand and be able to work with me. What it did instead was shut them down to the possibility of helping me. They wrote it off as something they don't support and that's that. Regardless, still trying to figure this out.

So what I mean by can't access Microsoft Apps is this: I downloaded the Outlook and Teams Apps. On the initial Microsoft sign-in page, I enter my university email address. That auto sends me to the university's login site. When I enter my credentials there (same as I do on my laptop), it automatically says login credentials are incorrect. There is no loading, no signs of the site actually processing my data, just immediately says email/password incorrect.

I then tried going to the web version of outlook to sign in and the same thing happens. So then I try to log in to my HR portal via mobile web just to see if I can successfully log in to any site that my University requires credentials for, and the same automatic error message appears. I did finally get IT to tell me that they have not seen any authentication attempts with my credentials on a non-windows device, despite me trying this for a better part of a month now. So this tells me that something on my phone is blocking authentication attempts to the University in some way... I've tried looking up the settings that would prevent communication but I'm still running up short on ideas. I've checked all of my browser settings and turned a whole bunch off to see if that was the issue, but regardless of what I try I'm unable to successfully get past the credentials stage, on either apps or via mobile web access.

It was actually really helpful to learn that the authentication attempts aren't even reaching the University's platform, so if you have ideas for other specific questions to ask IT that could help rule in/out what's happening I would really appreciate it. Or if you know of any settings on the phone that might be blocking these attempts, that would also be helpful. It might be important to note that I'm able to log in to all other websites, apps, or services that I've used on previous mobile devices, it's just the university ones I'm unable to access.

I'm less concerned with anonymity as long as I can get access to my accounts on mobile. I'm a lab safety professional and am regularly on call for lab incidents, so having access on my phone is crucial. For now, I'm using my old device for these notifications but obviously that's not ideal long-term.

ryrona

cnphilips I'm less concerned with anonymity as long as I can get access to my accounts on mobile. I'm a lab safety professional and am regularly on call for lab incidents, so having access on my phone is crucial. For now, I'm using my old device for these notifications but obviously that's not ideal long-term.

However much you would like to be able to access cooperate resources using your private phone, it is up to the company (or in this case university) that you are working at to decide what devices are allowed that access or not. Oftentimes, companies do not allow access to the company network from private devices at all, for security reasons.

So, most of us have to use two phones, one private, and one provided to you by your employer. The only responsibility your employer has it to make sure you have all the equipment you need to be able to carry out your work. It doesn't mean you get to choose what equipment. In this case, if you tell them you cannot carry out your work, they would either have to permit your private phone access, or provide you with a phone. I think most would see the latter happening in that case, and that is just how it is.