So yes it looks like the "LinkNYC Private" network is indeed using full-blown WPA2-Enterprise IEEE 802.1X EAP-TLS w/ client certs. It looks to be using Wi-Fi P

So yes it looks like the "LinkNYC Private" network is indeed using full-blown WPA2-Enterprise IEEE 802.1X EAP-TLS w/ client certs. It looks to be using Wi-Fi Passpoint "online sign up" (OSU) setup for client cert provisioning. Unfortunately, it does NOT look like it uses OSEN (WFA-UNAUTH-TLS type EAP-TLS) for the OSU WLAN, but instead chooses the option for an open OSU WLAN (using the same SSID as the non-private network) with a HTTPS captive portal. I would assume that this is the mechanism behind the reports of certificate downloads on iPhones. LinkNYC and Hotspot 2.0: https://medium.com/@LinkNYC/secure-browsing-on-linknyc-s-wi-fi-networks-4b5d25329b5a https://medium.com/@LinkNYC/secure-browsing-on-linknyc-s-wi-... https://www.globalreachtech.com/deployments/link-nyc/ https://www.globalreachtech.com/deployments/link-nyc/ Wi-Fi Passpoint aka Hotspot 2.0: https://www.wi-fi.org/downloads-public/Passpoint_R2_Deployment_Guidelines-v1%2B0.pdf/13481 https://www.wi-fi.org/downloads-public/Passpoint_R2_Deployme... http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-2/config-guide/b_cg82/b_cg82_chapter_01101000.html http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-2... Reports of cert provisioning: http://blog.alexflor.es/post/137705262900/linknyc-secure-gigabit-hotspot http://blog.alexflor.es/post/137705262900/linknyc-secure-gig... http://www.engadget.com/2016/01/19/linknyc-gigabit-wifi-hands-on/ http://www.engadget.com/2016/01/19/linknyc-gigabit-wifi-hand...