macOS RADIUS Wi-Fi SCEP certificate not appearing in KeychainSolved

Hi @shirleyc,

For macOS RADIUS Wi-Fi authentication, avoid deploying the same certificate through both a SCEP payload and a .mobileconfig profile in the same policy unless there is a specific reason to do so. This can make troubleshooting difficult and may result in the expected identity certificate not being available where the Wi-Fi payload expects it.

A cleaner approach is to test with one certificate deployment method at a time:

1. If you want Hexnode to issue certificates through SCEP, create a separate policy with the SCEP configuration and the Wi-Fi payload.
2. Associate it with a test Mac.
3. Confirm that the certificate appears in Keychain on the device.
4. Ensure the Wi-Fi configuration is using the certificate identity delivered by the SCEP payload.

If your existing .mobileconfig already contains the required certificate payload and Wi-Fi configuration, you may not need a separate SCEP configuration. In that case, deploy the .mobileconfig separately and verify whether the certificate is installed correctly.

A successful policy association only confirms that the policy was pushed to the device. It does not always mean the certificate was installed or selected correctly for network authentication, so checking Keychain on the Mac is an important validation step.

Best Regards,
Isabel Lora
Hexnode UEM

That helps. I found that the mobileconfig profile was already being used to deploy the certificate. After separating things out and testing a new SCEP-based policy, the correct certificate started showing up on the test Mac.

The Wi-Fi still does not always connect automatically, though. Sometimes it prompts for credentials manually.

If the certificate is now present in Keychain, the remaining issue is likely with the RADIUS authentication flow rather than basic certificate deployment.

Automatic connection depends on how the RADIUS server expects the device or user to authenticate. Check whether the network is configured for certificate-based authentication, user credential authentication, or a combination of both. The SCEP subject/SAN values and the Wi-Fi payload must match what the RADIUS server expects.

If manual credentials are still required, test with multiple user accounts to confirm whether the behavior is user-specific or network-wide. In some environments, updating or resetting the RADIUS-side user credentials may be needed if password-based authentication is still part of the flow.

The key takeaway is: use either the .mobileconfig certificate deployment method or the Hexnode SCEP payload for a given test path, verify the certificate in Keychain, and then tune the Wi-Fi/RADIUS settings for automatic authentication.

Best Regards,
Isabel Lora
Hexnode UEM