What's new 
I’m trying to connect an iPad to a Wi-Fi network using a Hexnode iOS policy. The policy installs a Wi-Fi profile, a trusted certificate, and a SCEP profile for Portnox CLEAR. The certificate from Portnox is visible on the iPad, but the device still won’t connect to the 802.1X Wi-Fi network. The SCEP part seems to be getting installed, so I’m not sure if the issue is with the Wi-Fi payload, the certificate trust settings, or something missing from the Portnox side. Has anyone configured Portnox CLEAR with iOS Wi-Fi through Hexnode? What certificates need to be included in the policy?
10 Views
Replies (1)
Marked SolutionPending Review
Hexnode Expert
18 hours ago
Sep 24, 2026
Marked SolutionPending Review
For iOS 802.1X EAP-TLS Wi-Fi authentication with Portnox CLEAR, make sure the Wi-Fi payload has the complete certificate trust chain required for both client and server authentication.
In this setup, two CA certificates are typically required:
- Tenant CA certificate
– Used to validate the client certificate issued to the iOS device through SCEP.
– This confirms that the device identity certificate is trusted. - Portnox Cloud Root CA certificate
– Used by iOS to validate the RADIUS server certificate during the TLS handshake.
– Without this, the device may reject the Wi-Fi connection before client authentication completes.
In Hexnode, upload both certificates in the same iOS policy under: Policies > iOS > Security > Certificates.
Then ensure the Wi-Fi configuration references the required certificate trust settings and uses the SCEP identity certificate for EAP-TLS authentication. For Portnox CLEAR, also confirm that the trusted server certificate name is configured as required by the RADIUS server, for example: clear-rad.portnox.com.
After saving the policy, push it again to the iOS device and retry the Wi-Fi connection.
Save