Ryan Burnette Updated September 29, 2026 July 24, 2020 AI

UniFi Dream Machine Pro wpa_supplicant

AT&T fiber gates your connection behind 802.1X (EAP-TLS), and their residential gateway is what holds the certificate that passes it. Pull that certificate out, run wpa_supplicant on the UDM-Pro’s WAN port, and the UDM authenticates the line itself. The ONT plugs straight into the router and the AT&T box goes on a shelf.

I first wrote this in 2020 pointing at a couple of community scripts. The idea is the same; the way I run it now is cleaner and survives firmware updates. This is how it works on a current UniFi OS.

Bring your own binary, keep everything in /data

UniFi OS ships no wpa_supplicant you can count on, so you supply your own. What makes the setup hold up is keeping that binary and everything it needs in /data, which survives reboots and firmware updates.

An update replaces the whole base OS image, and that is the part that bites. Anything you borrow from the system can change version or disappear outright: UniFi OS 5.x dropped /sbin/wpa_supplicant from the image entirely, which broke every setup pointing at it, mine included. On my UDM-Pro /etc has survived each update so far, so the unit file itself stays put. I would not build on that though. The binary, libraries, certs, and config all live in /data, where an update has no reach.

Layout

Everything lives under /data/att-supplicant/ on the UDM-Pro:

/data/att-supplicant/
  bin/wpa_supplicant        # you supply this; the OS doesn't include one
  lib/libpcsclite.so.1      # the one extra lib the binary needs
  conf/wpa_supplicant.conf
  conf/ca.pem
  conf/client.pem
  conf/private_key.pem

/data is where the UniFi controller keeps its own database, which is why it survives updates.

Get the certificates

You need the EAP-TLS certificate and private key from an AT&T gateway: a CA chain, the client certificate, and the private key. Extracting them from the gateway’s manufacturing data is its own topic and well documented elsewhere (search for mfg_dat_decode). The EAP identity is the gateway’s WAN MAC address. Drop the three PEM files in conf/, and guard them closely: don’t share them, and don’t lose them.

Get a wpa_supplicant binary

The UDM-Pro is aarch64 with a Debian bullseye userland, so the official Debian arm64 package is a drop-in. Pull it apart on any machine and copy the binary over:

# arm64 wpa_supplicant
curl -fsSLO https://deb.debian.org/debian/pool/main/w/wpa/wpasupplicant_2.9.0-21+deb11u3_arm64.deb
ar x wpasupplicant_*.deb && tar xf data.tar.xz
# binary is ./sbin/wpa_supplicant

# its one extra dependency, libpcsclite
curl -fsSLO https://deb.debian.org/debian/pool/main/p/pcsc-lite/libpcsclite1_1.9.1-1_arm64.deb
ar x libpcsclite1_*.deb && tar xf data.tar.xz
# lib is ./usr/lib/aarch64-linux-gnu/libpcsclite.so.1.0.0  (copy it as libpcsclite.so.1)

Put wpa_supplicant in bin/ and libpcsclite.so.1 in lib/. Confirm it runs and nothing else is missing:

LD_LIBRARY_PATH=/data/att-supplicant/lib ldd /data/att-supplicant/bin/wpa_supplicant | grep "not found"
LD_LIBRARY_PATH=/data/att-supplicant/lib /data/att-supplicant/bin/wpa_supplicant -v

The config

conf/wpa_supplicant.conf, pointing at the certs by their /data path:

eapol_version=1
ap_scan=0
fast_reauth=1
network={
    ca_cert="/data/att-supplicant/conf/ca.pem"
    client_cert="/data/att-supplicant/conf/client.pem"
    private_key="/data/att-supplicant/conf/private_key.pem"
    identity="XX:XX:XX:XX:XX:XX"
    eap=TLS
    eapol_flags=0
    key_mgmt=IEEE8021X
    phase1="allow_canned_success=1"
}

identity is the gateway WAN MAC. No MAC cloning on the UDM is required; the certificate is what authenticates.

The systemd unit

/etc/systemd/system/att-supplicant.service. It runs the /data binary, sets LD_LIBRARY_PATH so the loader finds the bundled lib, and restarts if it ever dies:

[Unit]
Description=AT&T EAP-TLS wired supplicant (eth8)
After=local-fs.target

[Service]
Type=simple
Environment=LD_LIBRARY_PATH=/data/att-supplicant/lib
ExecStart=/data/att-supplicant/bin/wpa_supplicant -s -Dwired -ieth8 -c/data/att-supplicant/conf/wpa_supplicant.conf
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

Two things. eth8 is the UDM-Pro’s WAN port; confirm yours with ip -br link and match where the ONT is plugged in. And do not order this After=network-online.target, which is tempting but wrong: this service is what brings the network online, so waiting on the network deadlocks after a firmware update.

Enable and start it, then watch for the handshake:

systemctl daemon-reload
systemctl enable --now att-supplicant.service
journalctl -u att-supplicant -f   # look for CTRL-EVENT-EAP-SUCCESS

Once you see EAP-SUCCESS, the WAN DHCP lease shows up within a few seconds and you are online.

After a firmware update

Most updates need nothing. The unit lives in /etc, everything it runs lives in /data, and the supplicant comes back on its own. Going from UniFi OS 5.1.19 to 5.1.33 logged EAP-SUCCESS two seconds after the service started, with the WAN lease intact and no intervention from me.

If the WAN is down afterward:

Try the SSH credentials you already have. A major jump (4 to 5) reset the password and changed the login prompt; a minor update left both alone. Go re-set it in the console UI once you have actually been refused, not before.
Usually systemctl restart att-supplicant is all it takes.
If the binary won’t start, the base OS moved to a newer Debian and a shared library went missing. Run the ldd check above and bundle whatever it names into lib/, the same way as libpcsclite. This is the whole reason for keeping the binary self-contained.

Worth knowing before you need it: besides the bundled libpcsclite, the binary pulls nine libraries off the base OS.

libc.so.6       libdl.so.2           libm.so.6
libssl.so.1.1   libcrypto.so.1.1     libdbus-1.so.3
libnl-3.so.200  libnl-genl-3.so.200  libnl-route-3.so.200

The openssl pair is what breaks. A bullseye-built wpa_supplicant asks for libssl.so.1.1, and bookworm ships libssl.so.3. Different soname, so the loader gives up. The fix is to bundle the bullseye libraries, the ones the binary was actually built against, not the newer ones off the upgraded base. Note the three separate libnl sonames and libdbus in there too. Collect the whole set in one pass rather than finding them one ldd run at a time with your WAN down.

Older references

Background on the concept and extracting the certs:

https://github.com/pbrah/wpa_supplicant-udmpro
https://github.com/unifi-utilities/unifi-common (formerly boostchicken/udm-utilities)

Categories:

UniFi