Are you trying to deploy a certificate to a device? There are many ways to do this, and different types of certificates. The three major uses we see for certificates are:

This guide will walk you through how to accomplish each of these on ManageXR.

Behavior: Device requires a user certificate to authenticate with your Wi-Fi Network

Cause: TLS networks use certificates to authenticate devices

Solution: Find the correct user certificate by working with your IT admin and deploy it with the Wi-Fi profile in ManageXR

Enterprise Wi-Fi networks using EAP-TLS require a user certificate to determine whether a device is allowed to connect. This certificate identifies a specific user and signals to the RADIUS server that the device is authorized to join the network.

If you’re not setting up a network that uses EAP-TLS, this isn’t the right section for you!

FAQs & Troubleshooting: User Certificates

Behavior: Android 14 devices will not successfully deploy a Wi-Fi network without a CA Certificate + domain

Cause: Android 14 requires both a CA Certificate and domain to deploy Wi-Fi via an MDM (which beefs up security)

Solution: Find your CA Certificate using the guide below and attach it to the Wi-Fi profile in ManageXR

A CA Certificate (Certificate Authority Certificate) is a certificate used to verify the authenticity of other certificates—kind of like a trusted stamp of approval. It's often used with Wi-Fi networks to securely connect devices, especially when using enterprise-level networks (like ones that use RADIUS authentication).

While some devices don’t strictly require a CA Certificate to connect to Wi-Fi, Android 14 devices require it. This includes:

To avoid issues with Wi-Fi connectivity or network updates, we strongly recommend that you always include both:

Doing so not only ensures compatibility with all devices but also adds an important layer of security. It helps protect against Man-in-the-Middle attacks, where someone might try to impersonate your network’s authentication server (RADIUS) to steal sensitive credentials or certificates.

If you’d like to learn more about the background for this, we recommend checking out this article.

The CA Certificate you use will be based on the certificate your RADIUS servers use. There are two main methods to find this certificate:

Follow the instructions to view and export a CA certificate on your computer:

This method requires getting the certificate deployed on your RADIUS server, and then using it to identify the correct CA cert. Follow the instructions for your computer:

Behavior: Devices will connect to a network, but will not be able to communicate with the internet

Cause: Devices think their traffic is being intercepted, so will fail to send requests rather than risk exposing themselves

Solution: Upload your certificate file to the ManageXR Web Console and then reach out to support@managexr.com specifying which configuration(s) you would like the certificate to be deployed to.

A content filtering system monitors all outgoing traffic and then forwards it onwards to the internet so it can make sure internet use is only according to the policies set. As part of this, it basically performs a “Man-in-the-Middle” attack. If an untrusted third party was doing this, they would be trying to gain access to all of your web traffic! As a result, devices do not trust the additional certificate added as part of this system by default.

The solution to this is to install the certificate on the device. This usually means adding another CA Certificate. This is different from the above, because it gets installed at the device level so all applications can use it, as opposed to being attached to a specific Wi-Fi network.

Instructions

If your devices are connected to a Wi-Fi network and still can’t communicate with the internet, your network may use a Content Filtering System or Reverse Proxy. We recommend following these steps:

FAQs & Troubleshooting: Self Signed CA Certs