KUBUNTU / ANDROID / SCEP
Linux and Android on the Same PKI
Getting certificate-based network access working on Windows was only part of the project. I also wanted Kubuntu and Android devices to join the same enterprise Wi-Fi without sharing a password, and each platform needed a different enrollment approach.
Kubuntu and Active Directory
I joined a Kubuntu workstation to the domain using realmd, SSSD and Kerberos, then checked domain account and group resolution. Wired and wireless NetworkManager profiles use managed EAP-TLS client certificates. I also set up certificate renewal automation and tested the resulting connection behavior.
I kept a separate local administrator account so that a directory or network problem wouldn't leave me without a recovery path. The Linux setup also has its own login-session and WireGuard integration notes.
Android and managed certificates
For Android, I used mobile device management with SCEP enrollment through the internal NDES service. The managed profile installs the relevant trust material and a client identity, which Android can then use for EAP-TLS Wi-Fi. I tested that on multiple devices, including work-profile scenarios.
One surprise was that applying the Wi-Fi configuration could trigger another SCEP request. I investigated that as part of the profile workflow rather than assuming Wi-Fi authentication was broken. The devices connected successfully.
Renewal and cleanup
On Kubuntu, I have a documented certificate renewal process. Android enrollment is working too, but I still want a cleaner way to retire older certificates after a replacement has been issued. That matters because a new certificate doesn't automatically revoke the old one.
The Proxmox host has its own Active Directory and HTTPS integration; I cover that under the virtualization setup rather than mixing it into the workstation enrollment story.
The extra Android SCEP request → How EAP-TLS works in BiXCore →