What's new 
I’m trying to connect an iPad to a Wi-Fi network using a Hexnode iOS policy. The policy installs a Wi-Fi profile, a trusted certificate, and a SCEP profile for Portnox CLEAR. The certificate from Portnox is visible on the iPad, but the device still won’t connect to the 802.1X Wi-Fi network. The SCEP part seems to be getting installed, so I’m not sure if the issue is with the Wi-Fi payload, the certificate trust settings, or something missing from the Portnox side. Has anyone configured Portnox CLEAR with iOS Wi-Fi through Hexnode? What certificates need to be included in the policy?
151 Views
Replies (1)
Marked SolutionPending Review
Hexnode Expert
3 weeks ago
Sep 24, 2026
Marked SolutionPending Review
For iOS 802.1X EAP-TLS Wi-Fi authentication with Portnox CLEAR, make sure the Wi-Fi payload has the complete certificate trust chain required for both client and server authentication.
In this setup, two CA certificates are typically required:
- Tenant CA certificate
– Used to validate the client certificate issued to the iOS device through SCEP.
– This confirms that the device identity certificate is trusted. - Portnox Cloud Root CA certificate
– Used by iOS to validate the RADIUS server certificate during the TLS handshake.
– Without this, the device may reject the Wi-Fi connection before client authentication completes.
In Hexnode, upload both certificates in the same iOS policy under: Policies > iOS > Security > Certificates.
Then ensure the Wi-Fi configuration references the required certificate trust settings and uses the SCEP identity certificate for EAP-TLS authentication. For Portnox CLEAR, also confirm that the trusted server certificate name is configured as required by the RADIUS server, for example: clear-rad.portnox.com.
After saving the policy, push it again to the iOS device and retry the Wi-Fi connection.
Save