Enterprise WiFi is the main reason most offices install FreeRADIUS: a personal login per person instead of one shared password. The access point side takes four values — the honest work is EAP and the certificate your devices must trust.
Everything so far — install, client, user, radtest — builds the foundation. This page puts it to work on the use case most people actually want: WPA2 Enterprise WiFi backed by FreeRADIUS. You will see the small access-point configuration, the EAP tunnel that carries real WiFi logins, and the certificate step that decides whether the first phone connects smoothly or refuses with a frightening warning.
Home WiFi has one shared password for everybody. WPA2 or WPA3 Enterprise replaces it with a personal login for each user — the same FreeRADIUS accounts you have been building. The access point stops checking passwords itself and forwards every login to the server, which is why this whole setup exists.
On the access point you set the security mode to Enterprise (sometimes labelled WPA2-EAP or 802.1X), enter the server IP, port 1812, and the shared secret from that AP's clients.conf entry. That is genuinely all the AP side needs. Everything else happens between the user's device and the server.
WiFi logins travel inside EAP, a protected tunnel between the phone or laptop and FreeRADIUS. The common methods are PEAP and EAP-TTLS (username and password inside the tunnel) and EAP-TLS (a certificate on the device itself — the strongest, and the most work to roll out).
Here is the honest part most quick guides skip: radtest cannot test any of this. It speaks plain RADIUS, not EAP. Your radtest can pass perfectly while every phone still fails, because the failure lives in the EAP layer — almost always the certificate, covered next. Prove the core with radtest first, then test EAP with one real device while watching the server debug output.
Inside the EAP tunnel, the server proves its identity with a certificate before any password is sent. FreeRADIUS ships test certificates in /etc/freeradius/3.0/certs/, created by running sudo ./bootstrap in that folder. They are fine for a lab — and phones will still complain, because a self-signed test certificate is not trusted by any device.
The EAP settings themselves live in /etc/freeradius/3.0/mods-enabled/eap — the default method and certificate paths are set there. Change one thing at a time and restart with sudo freeradius -C checked first.
The complete setup on a real Ubuntu server — install, first client, first user and the live test, all shown step by step in the video.
▶️ Watch Full VideoThe EAP layer, most likely the certificate. Radtest tests plain RADIUS only. Watch sudo freeradius -X while a phone tries to join: if you see EAP errors or the handshake stopping at the certificate stage, the phone does not trust the server certificate. Use a certificate your devices trust and re-test with one device first.
PEAP with username and password is the common small-office choice because phones and laptops support it natively and no per-device certificates must be installed. EAP-TLS, where each device carries its own certificate, is stronger and removes passwords from WiFi entirely, but it needs a proper certificate rollout. Either is a large step up from one shared WiFi password.
They are meant for testing. Devices do not trust a self-signed test certificate, so users will see warnings — and teaching users to tap through certificate warnings destroys the main security benefit of Enterprise WiFi. For production, use a certificate from a CA your devices already trust.