University iPhones must use EAP-TLS on the campus WLAN. Students who only receive a verbal passphrase cannot get the phones to present a certificate. What do the phones need before they can connect that way?
Select an answer to reveal the explanation.
Short Explanation
An iPhone will not invent a certificate because someone told it a passphrase in the hallway. Your students need a profile that actually carries the EAP-TLS identity and trust. Hiding the network name does not mint that certificate.
Full Explanation
EAP-TLS on a phone needs a client identity certificate, the trusted server chain, and the WLAN's EAP settings in the supplicant. iPhones take that bundle from a configuration profile, installed by the user or pushed by mobile device management. A verbal passphrase does not populate any of those objects, so the phone cannot present a certificate. A pre-shared key is not converted into an EAP-TLS certificate. The phone would be joining a different security type entirely if the WLAN were PSK. A hidden SSID only omits the name from beacons. It does not generate a client certificate or complete enrollment. Restricting the WLAN to 2.4 GHz changes the band. It does not disable certificate checks, and an EAP-TLS supplicant still needs the certificate on whichever band it uses. Exam caveat: the profile has to match the SSID and the EAP type exactly. A profile for a different network name sits unused while students join the real SSID with no identity. Operational check: on a failing iPhone, look for the installed profile and the client certificate, then compare the SSID inside the profile with the campus WLAN.