Network profiles

Define the network once.

Administrators manage configurations at /networks. Define an EAP-TLS Wi-Fi network with SSID, WPA2/WPA3 selection, and trusted RADIUS server names, or an IKEv2 VPN with gateway address and remote identifier. The portal also supports an optional PEM trust anchor and enabling or disabling a configuration.

Your RADIUS server or VPN gateway must already support certificate authentication, trust the device issuer, and present a certificate matching the configured server identity. myOwnMDM creates client-side configuration; it does not configure your gateway or access points.

docker compose exec ca devica network add-wifi   --name "Office Wi-Fi" --ssid "Example Office"   --security WPA2 --server-names radius.example.com

docker compose exec ca devica network add-vpn   --name "Office VPN" --server vpn.example.com   --remote-id vpn.example.com
docker compose exec ca devica network list

The CLI exposes a smaller set of settings than the portal. Use the portal for custom anchors and additional Wi-Fi options. Only enabled network configurations are included in newly generated delivery files.

Apple: network payloads in the signed profile.

The .mobileconfig embeds enabled Wi-Fi and VPN definitions alongside CA trust and SCEP enrolment. Payloads reference the SCEP-enrolled certificate. Wi-Fi uses EAP-TLS; the VPN uses IKEv2 certificate authentication.

Download and install a new profile when changing settings. Installation is a device-side workflow, with no remote push channel.

Windows: apply settings through PowerShell.

The enrolment script bundles enabled network configurations and installs the device credential. Windows Wi-Fi XML profiles validate configured server names and trust anchors. VPN settings use the generated certificate-authentication configuration.

For an existing endpoint, download /windows/netcfg and run the standalone script elevated to apply current settings. This script installs CA trust and network configuration; it does not issue a new device certificate.

Android: strongSwan and manual Wi-Fi.

The Android delivery page supplies a .sswan file for each enabled VPN. Each file includes the protected device PKCS#12, the gateway identity, and CA trust information. Import it into strongSwan and supply the generated passphrase.

Stock Android has no app-free importable EAP-TLS Wi-Fi profile in this workflow. Add the SSID manually, choose EAP-TLS, select the installed device credential and CA, and use the supplied RADIUS server identity. Device/version-specific credential options may differ.

Configuration delivery and access enforcement.

Changing a definition in the portal affects subsequently generated files. It does not automatically update or remove settings already installed on endpoints. Disabling a configuration also does not disconnect devices that already have it.

Linux and IoT clients use their own network tooling after certificate enrolment. For all platforms, configure and test server-side CRL or OCSP checking. Certificate revocation publishes status; your relying service decides how to enforce it.