WPA2 Enteprise

[jraffa]

Yesterday I bought my Kindle PW3W (Paperwhite wifi only)
I tried to make it work with the wi-fi connection of my university. I followed instructions similar to this.
I created the "certs" followed, converted the p12 certificate into pem, and configured the network with "advanced" settings.

Unfortunately I arrived at a message box which says something on the line of "WPA2 Enterprise" is not supported. I don't have any idea why in the wi-fi advanced connection settings there is the option to select WPA2 Enterprise if it is not supported. I hypothesize that the instructions on that website refer to a previous Kindle version?

So, is there a hack to allow to to connect to WPA2 Enterprise network? Or are there other e-book readers that allow me to do that? I have 14 days to return back the Kindle

I looked into Kobo
FAQ and there is written that it does not support WPA Enterprise either. Maybe it supports WPA2 Enterprise? Or are there other e-book readers with such a support?

Thanks in advance

[coplate]

Can you give a screenshot of the folders and files on the kindle, to help understand if there may have been something set up wrong.

Also, this sounds like it may be a good thing to talk to Kindle chat support, they may be able to help you more than some people here.

[knc1]

"I followed instructions similar to this."

Would you please provide a link to the instructions you actually followed.
Or describe what you did differently than what is described at the link you gave.

You have a technical question about a technical feature.
We really need all of the technical details.
More than just: "similar to".
A lot of things might be "similar to" but not be what is required.

Also include what firmware version the device is currently running.
You can find that on the "Device Info" panel that is part of the "Settings" menu tree (I can't say specifically, since I don't know your firmware version).

Kindles have supported WPA(2) Enterprise since firmware version 5.1.something.
See:
https://www.mobileread.com/forums/sh...d.php?t=168750
And specifically:
https://www.mobileread.com/forums/sh...4&postcount=11

When using ixtab's extension rather than Amazon's built-in support, the Kindle has to be jailbroken to add a company certificate.
Keep in mind, fw 5.1 was a long, long, long time ago in the history of Kindle firmware.

Have you tried looking up the how to setup this feature in the Kindle User's Guide that is installed on your Kindle?

One of the reasons I ask what specific instructions you used and what specific firmware version your device is running.

[jraffa]

I have a Kindle PaperWhite Wi-Fi only.
The first letters of the serial number are: G090 KB03. This corresponds to PW3W.
Firmware version is 5.8.10 (3202090019)

Here is the wpa_supplicant configuration file of the wireless network I am trying to connect to. It's the wi-fi of the university. Personal credentials omitted.

###
# polimi-protected.conf
###
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
ap_scan=1
network={
ssid="polimi-protected"
proto=WPA RSN
key_mgmt=WPA-EAP
auth_alg=OPEN
pairwise=CCMP TKIP
eap=TLS
ca_cert="~/ca.pem"
subject_match="/C=IT/O=Politecnico di Milano/OU=POLIMI/CN=wifi.polimi.it"
private_key="~/wifiCert.p12"
private_key_passwd="[OMITTED]"
phase2="auth=MSCHAPV2"
identity="[OMITTED]"
}

Also, as you can see there is no password. But if I don't put a password in Kindle, the "connect" button is greyed out.

Here is the command pipeline that I run. I have Windows 10.

1. Download the certificate from my university website. It's in PKCS12 format
2. Run this command:

openssl pkcs12 -in wifiCert.p12 -out wifiCert.pem

The resulting PEM file contains 1 certificate and 1 encrypted private key
3. Connect Kindle to pc with integrated usb cable
4. Open explorer -> Kindle drive -> create the folder "certs"
5. Copy "wifiCert.pem" into "certs"
6. Renaming "wifiCert.pem" into "polimi_wificert.crt"
6. Unplug Kindle from PC after unmounting it
7. Now I take my Kindle device and click on: settings-> wireless -> other. I fill the form as follows:

Network name: polimi
Connection type: DHCP
Security type: WPA2
Version: Enterprise
EAP method: PEAP
Phase 2 Authentication: MSCHAPv2 (it's greyed out. I can't change it)
CA certificate: polimi_wificert.crt
User name: [the "identy" field of polimi-protected.conf]
Password: a
The password is incorrect and should be empty. But if it's empty the "connect" button is greyed out

Then I click connect and a message box "WPA2 Enterprise not supported" shows up

I attach the screenshots of the relevant part of Kindle drive folder structure

[jraffa]

The Kindle user guide does not talk about WPA Enterprise at all. It only describes how to connect to wifi network protected with a password. No description for networks that require a company certificate is provided. But it doesn't say that WPA2 Enterprise is not supported either. It says that ad-hoc wi-fi connections are not supported

EDIT: Also, the link I posted is for instructions in italian I am sorry for that

[coplate]

Originally Posted by jraffa

The Kindle user guide does not talk about WPA Enterprise at all. It only describes how to connect to wifi network protected with a password. No description for networks that require a company certificate is provided. But it doesn't say that WPA2 Enterprise is not supported either. It says that ad-hoc wi-fi connections are not supported

EDIT: Also, the link I posted is for instructions in italian I am sorry for that

I found these when I started loking some more:

https://www.mobileread.com/forums/sh...d.php?t=197459

https://tribut.de/blog/amazon-kindle-and-eduroam/


Is there anything different about what you did from this?


It doesn't mention putting in a password either, and the connect button is greyed out in the screenshot.



I also recommend again, if you have not tried yet, you can contact amazon over chat and ask them for help.

[knc1]

The second link that coplate posted above:
https://tribut.de/blog/amazon-kindle-and-eduroam/
looks like you best choice.

You will find in the directions that you have to convert the certificate format.
If you don't have a means to do that on your PC, your Kindle has the software pre-installed that will do that, but the Kindle has to be jail broken to run the command.

The Kindle also has the various utilities pre-installed to trouble shoot the problem.
But again, you have to be jail broken.

Since you have already installed 5.8.10 you can not jb the one you have.

Send yours back under the "no questions asked" return policy and then either purchase a refurbished one or a new one from Amazon (Germany).
Do not allow this second one to connect with the Internet until after you have jail broken it.

Once that is done, then you will have a means to run command line commands on the Kindle and we can walk you through updating the information from that blog about getting a PW-1 to work.

I.E:
You get the feature you want, we (and the world who can find us) get an updated setup procedure.
If you have trouble with following the current jail break instructions, just post here, we can probably find someone that can walk you through them in your native language.

= = = =

PS:
I think we will find that the password referred to in the setup panel is for a password protected certificate.
Since the certificate already authenticates you to the network.

[baf]

Originally Posted by jraffa

key_mgmt=WPA-EAP
auth_alg=OPEN
pairwise=CCMP TKIP
eap=TLS

You need EAP-TLS. I don't think eink kindles support it, even with most recent firmware.
In the menu there is only choice between PEAP and EAP-TTLS.

[jraffa]

Is there anything different about what you did from this?

I wrote all the passages I followed so you can check

The second link that coplate posted above:
https://tribut.de/blog/amazon-kindle-and-eduroam/
looks like you best choice.

Yeah that was what I followed, except my certificate came in PKCS 12 format

In the end I don't think it's worth the hassle to invalidate the warranty. Moreover the jailbreak you are referring to involve only "software" think right? Because I am not able to dismantle the device

Moreover I have a personal WPA at home and the USB cable for the university anyway (my PC can connect to the university network). And don't have much time to try the jailbreak and the like right now

Or maybe I can wait for a 5.8.10 jb, if there is some chance for it

[jraffa]

Amazon chat support confirmed that Kindle does not support wifi connections that requires a certificate

[jraffa]

Eventually when I will have time, this would work, right?

[SKK]

Originally Posted by jraffa

Eventually when I will have time, this would work, right?

Not if you are on 5.8.10.

[knc1]

You seem to be getting a lot of wrong information.

Our software jailbreak does not effect your warranty.

There is no chance for a software only jail break of 5.8.10

Amazon chat is wrong and they usually are about very technical aspects of the firmware.

No, the thread you linked to has never been maintained by the author.
You can see by the edit date of a year ago last August.

The only one that is current for your device is:
https://www.mobileread.com/forums/sh...d.php?t=275877
And you must take up that option to return your current device within the two weeks that you mentioned in order to get one with old enough firmware to jail break.
Waiting around until you "get the time" is not an option.

[jraffa]

How do you know I will get a firmware version < 5.8 ? Isn't it reasonable that new devices are sold with the new firmware?

Also, if I should get the wifi+3g version, how can I impede it to connect to the internet? Is the firmware updated with 3g?

[knc1]

Close but close only counts in horseshoes and Nuclear weapons.

"New" devices have the "newest" firmware the factory has prior to packing. (What has been released to the factory to use does not have anything at all to do with what has been released to the customers.)

The Kindles do not / can not update while in the box.

These devices are built in very large batches, packed, and then they require time to reach the customer.
There can be many delays along the way.
They are not 'built to order'. They are built much, much faster than they can be sold.

If the customer firmware release is updated, the boxes are not all opened (millions of boxes) and the installed firmware again updated.

I do not know what firmware version you will get.
But it can not be worse than a firmware version that you can not jail break.
We are still getting reports of devices shipping with firmware versions that can be jail broken from the two sources I suggested that you use.

No, the Kindles do not OTA update over 3G (other than the series 2 Kindles, which are 3G only).