Radius - ETH Zürich

Windows

No action is required on Windows.

Linux

After the CA certificate change, you may need to reinstall the new certificates for the eth network connection to work again. The same applies when setting up the connection for the first time.

Download the Root CA from pkiaia.ethz.ch/aia/ETHZRootCA2020.pem and the Intermediate CA from pkiaia.ethz.ch/aia/ETHZIssuingCA2020.pem. For the exact steps to install the certificates and connect to an 802.1X network, please refer to your distribution's documentation.

macOS

After the CA certificate change, macOS may ask you to trust the new certificate presented by our Radius servers. The same applies when setting up the connection for the first time. Follow the steps below to verify and trust it, either manually or via the ETH Toolbox.

1. Check the certificate

When you join the eth network, macOS shows a dialog asking you to authenticate against radius-service.ethz.ch. Compare the certificate chain shown here (ETHZ Root CA 2020 / ETHZ Issuing CA 2020) with the details on this page before you continue.

macOS dialog asking to verify the certificate for the eth network

2. Certificate not yet trusted

Until the certificate is trusted, Keychain Access lists the ETHZ Root CA 2020 certificate with a warning that it is not trusted. You can fix this either manually or by connecting once through the ETH Toolbox, as shown below.

Keychain Access showing the ETHZ Root CA 2020 certificate marked as not trusted

3. Trust it manually

Double-click the ETHZ Root CA 2020 certificate in Keychain Access, open "Trust" and set "EAP (Extensible Authentication)" to "Always Trust". macOS will then mark the certificate as trusted for your account.

Certificate trust settings in macOS with EAP set to Always Trust

4. Trust it via the ETH Toolbox

Alternatively, connect once using the ETH Toolbox: it configures the trust setting for you automatically, so Keychain Access shows the certificate as trusted without any manual steps.

Keychain Access showing the ETHZ Root CA 2020 certificate marked as trusted

iOS

You can also connect to eduroam using the eduroam Configuration Assistant Tool (CAT), which configures everything automatically.

After the CA certificate change, iOS may show a notification asking you to trust the new certificate presented by radius-service.ethz.ch. The same applies when setting up the connection for the first time. Tap on it to open the certificate view shown below, then tap the "Vertrauen" (Trust) button in the top-right corner to accept it and complete the connection.

Until you confirm it, the certificate is marked as "Wird nicht vertraut" (not trusted), even though it was correctly issued by the ETHZ Issuing CA 2020.

iOS certificate dialog for radius-service.ethz.ch, not yet trusted

Android

You can also connect to eduroam using the eduroam Configuration Assistant Tool (CAT), which configures everything automatically.

After the CA certificate change, previously saved eduroam connections on Android may no longer connect. The same applies when setting up the connection for the first time. Follow the steps below to install the CA certificate and update your network settings.

1. eduroam does not connect

If eduroam shows up as "Gespeichert" (saved) but never actually connects, Android is missing the CA certificate it needs to trust our Radius server. Long-press the eduroam entry to edit its settings, as shown in the next step.

Android Wi-Fi settings showing eduroam saved but not connected

2. Edit the network

Long-press the eduroam entry in the Wi-Fi list and tap "Ändern" (Modify) in the menu that pops up to open its settings.

Android context menu for the eduroam network with the "Ändern" option highlighted

3. Install the CA certificate

Open the "CA-Zertifikat" dropdown and tap "Zertifikate installieren" to install a new certificate, or select "ETHZ Root" directly if you installed it before. If you have not downloaded it yet, get the Root CA from pkiaia.ethz.ch/aia/ETHZRootCA2020.pem first. QR code to download the ETHZ Root CA certificate Or scan the QR code to download the certificate directly.

Android CA certificate dropdown with "Zertifikate installieren" and "ETHZ Root" highlighted

4. Select the downloaded certificate

Android opens a file browser to pick the certificate to install. Navigate to your Downloads folder and select the ETHZRootCA2020.pem.crt file you downloaded.

Android Downloads folder showing the ETHZRootCA2020.pem.crt file

5. Save the network

Check that "CA-Zertifikat" now shows "ETHZ Root" and fill in your identity. Students use username@student-net.ethz.ch, staff use username@staff-net.ethz.ch. Then tap "Speichern" to save and connect.

Students

Android Wi-Fi settings for eduroam with the student identity (student-net.ethz.ch)

Staff