Android provisioner - SSL handshake failure on self signed certificates

[stegar123]

PacketFence version
pf version 15.0
rocky 8

Describe the bug
For self-signed certificates, for Android devices we have next error when we press button configure on phone.

Sep 10 09:40:34 localhost haproxy-portal-docker-wrapper[7884]: 192.168.254.73:48100 [10/Sep/2025:09:40:33.617] portal-https-192.168.254.254/1: SSL handshake failure Sep 10 09:40:34 localhost haproxy-portal-docker-wrapper[7884]: 192.168.254.73:48096 [10/Sep/2025:09:40:33.617] portal-https-192.168.254.254/1: SSL handshake failure Sep 10 09:40:34 localhost haproxy-portal-docker-wrapper[7884]: 192.168.254.73:48098 [10/Sep/2025:09:40:33.617] portal-https-192.168.254.254/1: SSL handshake failure

Pleas see also the screenshot from the phone

[JeGoi]

@stegar123 Please, try with a CA certificate, not a self signed.

[stegar123]

@JeGoi
I have copied the CA from PKI server to radius CA, and I had same issue

[JeGoi]

Here, the issue is even before any relation with PKI.
On Android the first step is to check if the HTTPS certificate is correct (No self signed)
The HTTPs Server Certificate and the RADIUS Server Certificate need to be signed by a well known CA to make it work with Android. The "RADIUS Server Certificate" can not be a wildcard certificate.
The PKI server radius needs to be added in "RADIUS Certification Authority Certificate(s)" on https://IP:1443/admin#/configuration/certificate/radius

[JeGoi]

Also: https://www.packetfence.org/doc/PacketFence_Installation_Guide.html#_android_specifications

[JeGoi]

And: from https://www.packetfence.org/doc/PacketFence_Installation_Guide.html#_install_the_ssltls_radius_certificate_on_the_server

[31.2.4. Install the SSL/TLS RADIUS Certificate on the Server]
Once you have received the SSL/TLS certificate from the Certificate Authority (CA), the final step is to install it on the RADIUS server. This involves configuring the RADIUS server to use the SSL/TLS certificate for encrypted communications.

Wildcard certificate is strictly restricted to HTTP, you can’t use this type of certificate for RADIUS.