Troubleshooting macOS Authentication Issues with SFUNET‑SECURE (Cached 802.1X Certificates)

Overview

This article explains how some macOS users may experience issues connecting to the SFUNET‑SECURE Wi-Fi network, even when using correct credentials and no Wi-Fi profiles are installed. This problem can be caused by a cached 802.1X certificate stored in the system configuration.

Details

Prerequisites

• Ensure that SFUNET-SECURE and eduroam are not known/saved networks on the device (see How to forget a Wi-Fi network on iPhone, iPad, Mac, or Apple Vision Pro)
• Ensure that the SFUNET-SECURE and eduroam Wi-Fi profiles have been removed
• Open System Settings > Network > Wi-Fi > Advanced. If a 802.1x certificate exists and can't be removed, proceed with the following below:

Simple Method

Before proceeding with the advanced method, you may be able to remove the certificate by doing the following:

1. Go to the Keychain Access app  on your Mac.

   To open Keychain Access, search for it in Spotlight, then press Return.

2. Select either the login or System keychain.

3. Search for "802.1x" and remove the entry

Advanced Method

If the entry doesn't exist or can't be removed, you can try the following (may require administrative access to the device):

1. Open the System Configuration Folder

   1. Open Finder.
   2. From the top menu, click Go → Go to Folder...
   3. Enter the following path and click Go:

      /Library/Preferences/SystemConfiguration/
      

2. Locate the 802.1X Configuration File

   1. Find the file named:

      com.apple.network.eapolclient.configuration.plist
      

   2. If this file is missing, look for any file containing 8021x or eapol in its name.

3. Rename the Configuration File

   1. Rename the file by appending .bak to the filename:

      com.apple.network.eapolclient.configuration.plist.bak
      

   2. You may be prompted to enter your administrator password to complete this action.

4. Restart the Mac

   • Reboot your Mac to apply the changes.

5. Reconnect to SFUNET‑SECURE

   • After restarting, reconnect to the SFUNET‑SECURE network.
   • Accept the new certificate when prompted.