Android 11 & 12 devices not connecting to internal wireless network

[Joe Della Valle]

Has anyone see this issue with Android devices not able to connect to Cisco wireless networks?

Looking at our ISE logs, it seems the devices are not puling down the wireless certificate. You can see the attempt to join the wireless network in ISE but then it just errors out with "PEAP failed SSL/TLS handshake after a client alert"

This is the resolution, but the wireless certificate is there but not being pulled down:

Check whether the proper server certificate is installed and configured for EAP in the Local Certificates page ( Administration > System > Certificates > Local Certificates ). Also ensure that the certificate authority that signed this server certificate is properly installed in client's supplicant. Check the previous steps in the log for this EAP-TLS conversation for a message indicating why the handshake failed. Check the OpenSSLErrorMessage and OpenSSLErrorStack for more information.

[Arshad Safrulla]

Latest Android OS removed the "do not validate" certificate option, which in older versions were used to bypass the full certificate validation. So due to this reason new Android OS versions doesnt allow access to any WPA2 enterprise networks which uses SSC, or any certificate from a CA which is in the Android certificate trust store.
Your options are either use a certificate signed by a public CA which is trusted by Android or upload the CA root/ intermediate certificates to Andoid device.

[Joe Della Valle]

Arshad,

That option has been removed from Android 11 & 12, so that will not work. 

[Arshad Safrulla · Accepted solution]

Which option is removed by Android?

I was recently part of a deployment where we pushed certificates to thousands of Android devices running 11 using MDM, I also tested in my personal devices. Certificates can be installed without any issues. Where did you get stuck?

[Joe Della Valle]

The option for "do not validate" is not available in Android 11 & 12, check a new Android 12 device, here in the States the option is removed. 

[Leo Laohoo]

CSCvu24770

[karl.greenwood.ext]

This Cisco bug states that it is applicable to Affected clients running Android 10.

[patoberli]

In my case I had to disable Fast Transition on the SSID under Security - Layer 2 recently. Might have been another issue though.