User-Initiated Certificate Generation 

Download your digital certificate to securely authenticate your device for corporate Wi-Fi and VPN access.

Generating a Certificate from the User Portal

1. Login to JumpCloud User Portal.
2. Go to Security and select the Certificate Authority tab.
3. Click Generate Certificate. The Generate Certificate pop-up window is displayed.
4. On the pop-up window, enter the required password.
5. Click Generate. A password protected certificate is generated in a zipped .pfx file. You can generate two certificates in one hour. 

Installing a Certificate on Devices

Windows

For Windows device, use the steps below to manually install the certificate:

Prerequisites

• A valid certificate file (for example, a .pfx or .p12 file) saved on your local machine.
• The private key password for the certificate.
• Administrative privileges on the Windows 11 device.
• Access to a Wi-Fi network that supports certificate-based authentication (WPA2/WPA3 Enterprise).

Installing a Certificate

1. Open the certificate file, select Current User as the Store Location.
2. Click Next until you reach the password screen.
3. Enter the private key password, select the Include all extended properties checkbox.
4. Click Next.
5. Select Place all certificates in the following store and click Browse, 
6. Select Personal, and click OK.
7. Click Next, then Finish, and confirm the "successful import" dialog by clicking OK.
8. Open the Wi-Fi menu from your system tray, select your target network (e.g., Cosmos2G Rad), 
9. Select the Connect automatically checkbox.
10. Click Connect using a certificate (instead of typing a password), 
11. Select your imported certificate from the dropdown, and click OK.
12. Finalize the connection by clicking Connect to authenticate with the network.

Mac

For installing certificates on a macOS device, use the steps below:

Prerequisites

• JumpCloud Admin Portal access with necessary permissions to manage RADIUS and Certificate Authorities.
• Cisco Meraki Dashboard access for wireless configuration.
• A local machine with Keychain Access (macOS) or a similar certificate manager.
• The appropriate user groups are already created in JumpCloud.

Installing a Certificate

1. Log in to the JumpCloud Admin Portal, 
2. navigate to Security > Certificate Authority.
3. Click + Add CA, and download the CA certificate.
4. Navigate to Security > Certificate Authority.
5. Click + Add to issue a certificate for your desired user, select the user checkbox, and click Save.
6. Go to Access > RADIUS.
7. Click +, name the server, enter the IP, and under the Authentication tab.
8. Select Passwordless and upload the CA certificate.
9. Select the User Groups checkbox for your group (for example, 'RADIUS Group'), click Save, and copy the generated Shared Secret.
10. Log in to the Meraki Dashboard.
11. Navigate to Wireless > Access control, and add a RADIUS server using the JumpCloud IP and Shared Secret.
12. Import the user .pfx file into Keychain Access, set the certificate trust to Always Trust, and connect to the Wi-Fi using the certificate as your Identity.
13. Return to JumpCloud Insights > Directory Insights to verify the successful login with the EAP Type listed as TLS.

Linux

For installing certificates on a linux device, use the steps below:

Prerequisites

• A Linux device (for example, Ubuntu) with OpenSSL installed.
• A valid .pfx certificate file located in your working directory.
• The import password for the .pfx file.
• Credentials for the target Wi-Fi network.

Installing a Certificate

1. Open the Terminal, navigate to your certificate's directory, and run openssl pkcs12 -in [filename].pfx -clcerts -nokeys -out client.crt to extract the certificate.
2. Run openssl pkcs12 -in [filename].pfx -nocerts -nodes -out client.key in the same directory and enter the import password to extract the private key.
3. Click the Network icon, navigate to Wi-Fi > All Networks.
4. Select the target network (for example, Cosmos2G Rad).
5. Set the Authentication method to TLS and 
6. Select the No CA certificate is required checkbox.
7. Click User certificate, select Select from file..., and choose the client.crt file created in step 1.
8. Click User private key, select Select from file..., and choose the client.key file created in step 2.
9. Enter your email in the Identity field, provide the User private key password, and click Connect.

Android

For installing certificates on an android device, use the steps below:

Prerequisites

• A valid certificate file (for example, a .p12 or .pfx file) downloaded to your device storage.
• The extraction password for the certificate file.
• Access to an Enterprise Wi-Fi network (WPA/WPA2-Enterprise).

Installing a Certificate

1. Navigate to Wi-Fi settings, select More settings, and tap Install certificates.
2. Select your certificate file from the Downloads folder and enter the extraction password.
3. Enter a unique name in the Certificate name field and tap Confirm.
4. Select the target Enterprise network (for example, JC Meraki - wireless WiFi) and tap Join this network.
5. Set the EAP Method to TLS and choose your installed certificate from the User Certificate dropdown.
6. Set the CA Certificate to None or Use system certificates, enter your Identity, and tap Connect.
7. Verify that the network status displays as Connected in the Wi-Fi list.

iOS

For installing certificates on an iOS devices such as iPhone and iPad, use the steps below:

Prerequisites

• Access to the identity certificate file on the device.
• The device passcode and the password for the certificate.
• Proximity to the target Wi-Fi network (for example, JC Meraki CBA).

Installing a Certificate

1. Open the Files app, tap the certificate file, and tap Close on the confirmation prompt.
2. Open Settings, tap Profile Downloaded, and select Install.
3. Enter your device passcode, tap Install through the warnings, and enter the certificate password.
4. Tap Done, navigate to Wi-Fi, and select the target network (for example, JC Meraki CBA).
5. Tap Mode, select EAP-TLS, then tap Identity and select the installed certificate.
6. Tap Join and select Trust to establish the secure connection.