# WPA2/WPA3-Enterprise Wi-Fi Source: [https://docs.qualcomm.com/doc/80-Y8730-5/topic/wpa2_wpa3_enterprise_wi_fi.html](https://docs.qualcomm.com/doc/80-Y8730-5/topic/wpa2_wpa3_enterprise_wi_fi.html) This chapter describes WPA2-Enterprise and WPA3-Enterprise (IEEE 802.1X/EAP) support on QCC730. Enterprise authentication uses a RADIUS server to verify credentials, providing stronger security than pre-shared key (PSK) modes. The QCC730 integrates the open-source wpa\_supplicant as the EAP engine on the host side while the firmware continues to own the 802.11 association and 4-way handshake. When the QCC730 reconnects to an AP with a cached PMKSA entry, it performs abbreviated TLS session resumption instead of a full EAP exchange. Note: This feature is available starting with the QCC730.ZE.1.0 Post-CS 1 release. The EAP method is selected with the `-k` parameter. WPA2 versus WPA3 behavior is controlled by the `-S` (WPA3 enterprise mode) and `-w` (MFP level) parameters, not by `-k`. The following tables summarize the supported values. | -k value | Zephyr security type constant | EAP method | | --- | --- | --- | | 12 | WIFI\_SECURITY\_TYPE\_EAP\_PEAP\_MSCHAPV2 | EAP-PEAP / MSCHAPv2 | | 14 | WIFI\_SECURITY\_TYPE\_EAP\_TTLS\_MSCHAPV2 | EAP-TTLS / MSCHAPv2 | | 7 | WIFI\_SECURITY\_TYPE\_EAP\_TLS | EAP-TLS (certificate, no password) | Note: EAP-TLS (`-k 7`) requires a CA certificate, a client certificate, and a client private key. The QCC730 supports runtime loading of these files from a LittleFS partition in external flash, so certificates can be updated without recompiling the firmware. The `-S` parameter selects the WPA3-Enterprise mode and, together with `-w`, determines whether AKM1 (WPA2-Enterprise) or AKM5 (WPA3-Enterprise) is used . | -S value | wifi\_wpa3\_enterprise\_type constant | AKM | -w required | | --- | --- | --- | --- | | 3 | WIFI\_WPA3\_ENTERPRISE\_ONLY | AKM5 (WPA3-Enterprise Only, MFPR=1) | 2 | | 4 | WIFI\_WPA3\_ENTERPRISE\_TRANSITION | AKM5 (WPA3-Enterprise Transition, MFPC=1, MFPR=0) | 1 | Note: `-S 1` (Suite-B) and `-S 2` (Suite-B-192) are defined in the Zephyr API but aren't validated on QCC730 in this release. ## Build the ent\_app to enable the enterprise feature In qapp\ent\_app, use the following command to build the image that supports WPA enterprise: west build -b qcc730mi -d build/qcc730miCopy to clipboard ## Create a LittleFS image Use lfsimg.py to pack certificate files into a LittleFS binary image. Test certificates are located under zephyr/samples/net/wifi/test\_certs/rsa3k/. The following example shows how to create a LittleFS image on Linux. 1. Create a directory to store the certificate files. CERT_DIR=/tmp/lfs_certs mkdir -p $CERT_DIRCopy to clipboard 2. Copy the required certificate files to the certificate directory. cp zephyr/samples/net/wifi/test_certs/rsa3k/ca.pem $CERT_DIR/ cp zephyr/samples/net/wifi/test_certs/rsa3k/client.pem $CERT_DIR/ cp zephyr/samples/net/wifi/test_certs/rsa3k/client-key.pem $CERT_DIR/Copy to clipboard 3. Generate a LittleFS image by using the following command: python lfsimg.py -s $CERT_DIR -f /tmp/lfs.bin --img_size 65536 --block_size 4096Copy to clipboard Note:In this command: - Source directory: `$CERT_DIR` - Output image: /tmp/lfs.bin - Image size: 64 KB (65536 bytes) - Block size: 4 KB (4096 bytes) ## Flash the LittleFS image On Windows, use the following command to flash the image to the LittleFS partition at offset 0x3000 in external flash. python nvm_programmer.py -s ch347 -i qcc730mi_prg.elf --nvm-name flash -b 0x3000 -f lfs.bin --resetCopy to clipboard ## Load certificates at runtime After flashing and rebooting, load the CA cert, client private key, and client certificate from the Zephyr shell before connecting: wifi load_certs -c /lfs/ca.pem -k /lfs/client-key.pem -e /lfs/client.pem Copy to clipboard Other useful certificate management commands: - Show currently loaded certificates wifi load_certs --listCopy to clipboard - Remove all loaded certificates wifi load_certs --clearCopy to clipboard Note: Run `wifi load_certs` each time the device boots, before issuing `wifi connect` with `-k 7` (EAP-TLS). Certificates are stored in RAM and are cleared on reboot. ## Connect to an enterprise AP **Command syntax**: wifi connect -s -k [-c ] [-w ] [-S ] -I [-P ] [-a ]Copy to clipboard Parameters: - `-s `: SSID of the enterprise AP - `-k `: EAP security type: 12=PEAP/MSCHAPv2, 14=TTLS/MSCHAPv2, 7=TLS - `-c `: Hint channel (optional, speeds up BSS scan) - `-w `: MFP level: 0=disabled, 1=optional, 2=required - `-S `: WPA3-Enterprise mode: 0=WPA2 only, 3=WPA3-Only, 4=Transition - `-I `: EAP identity (username) - `-P `: EAP password for PEAP/TTLS; omit for EAP-TLS (-k 7) - `-a `: Anonymous outer identity for PEAP/TTLS (optional) **Connection examples**: - WPA2-Enterprise EAP-PEAP/MSCHAPv2 (no PMF): wifi connect -s bssid -k 12 -c 6 -I rh -P passwordCopy to clipboard - WPA2-Enterprise EAP-TTLS/MSCHAPv2 (no PMF): wifi connect -s bssid -k 14 -c 6 -I rh -P passwordCopy to clipboard - WPA2-Enterprise EAP-TLS, certificate-based (no PMF): wifi load_certs -c /lfs/ca.pem -k /lfs/client-key.pem -e /lfs/client.pem wifi connect -s bssid -k 7 -c 6 -I user@example.orgCopy to clipboard - WPA3-Enterprise Only, PEAP/MSCHAPv2 (PMF required, AKM5): wifi connect -s bssid -k 12 -c 6 -w 2 -S 3 -I rh -P passwordCopy to clipboard - WPA3-Enterprise Only, EAP-TLS (PMF required, AKM5): wifi load_certs -c /lfs/ca.pem -k /lfs/client-key.pem -e /lfs/client.pem wifi connect -s bssid -k 7 -c 6 -w 2 -S 3 -I user@example.orgCopy to clipboard - WPA3-Enterprise Transition Mode, PEAP/MSCHAPv2 (PMF optional, AKM5+AKM1): wifi connect -s bssid -k 12 -c 6 -w 1 -S 4 -I rh -P passwordCopy to clipboard ## Fast reauthentication Last Published: Jul 30, 2026 [Previous Topic QCLI app](https://docs.qualcomm.com/bundle/publicresource/80-Y8730-5/topics/qcli-demo.md) [Next Topic OTA Firmware Upgrade Using mcumgr](https://docs.qualcomm.com/bundle/publicresource/80-Y8730-5/topics/ota_firmware_upgrade_using_mcumgr.md)