Key Points
- WPA3-Enterprise 192-bit mode enforces a minimum 192-bit security strength across the entire cryptographic chain, requiring RSA certificates of at least 3072 bits or ECDSA P-384.
- A 2048-bit RSA certificate, the default for most certificate authorities, provides only approximately 112-bit security and will cause Windows clients to reject authentication on a 192-bit SSID.
- In Intune and Jamf deployments, the SCEP profile’s key size setting overrides the CA web UI default. Admins can request 3072-bit or 4096-bit certificates without changing the CA configuration.
If your Windows devices are failing to connect after enabling WPA3-Enterprise (Wi-Fi Protected Access 3-Enterprise) on 6 GHz access points, the certificate you issued is almost certainly the problem.
Most certificate authorities (CAs) default to 2048-bit RSA, which does not meet the WPA3-Enterprise 192-bit mode specification. Windows has started enforcing this strictly, and the failure is silent enough to waste hours of troubleshooting.
What Is WPA3-Enterprise 192-Bit Mode?
WPA3-Enterprise 192-bit mode is a special mode for WPA3-Enterprise that enforces certain high-security requirements on the wireless connection to provide a minimum of 192 bits of security.
The “192” in the name refers to the minimum security strength across the entire cipher suite, not just the certificate key size. Every component of the cryptographic chain, including authentication, encryption, and key exchange, must meet that 192-bit threshold.
The mode aligns with the Commercial National Security Algorithm (CNSA) Suite, a set of cryptographic standards published by the National Security Agency (NSA) for protecting systems carrying classified and sensitive information.
In vendor documentation from infrastructure manufacturers, you will often see this mode listed as “Suite B,” “SuiteB-192,” or “SuiteB192-1X.”
WPA3-Enterprise 192-bit mode is distinct from standard WPA3-Enterprise:
- Standard WPA3-Enterprise improves server certificate validation over WPA2-Enterprise but does not mandate the same cryptographic floor.
- The 192-bit mode is an optional, higher-assurance operating mode intended for government, defense, finance, and other high-security environments.
What Are the Certificate Requirements for WPA3-Enterprise 192-Bit Mode?
The key size requirement is where most deployments break. WPA3-Enterprise 192-bit mode requires:
- RSA certificates: Minimum 3072-bit modulus (RSA-3072 or higher, including RSA-4096)
- ECDSA certificates: Minimum P-384 curve (384-bit elliptic curve)
A 2048-bit RSA certificate provides approximately 112 bits of security strength. That falls well below the 192-bit floor. The specification rejects it because allowing a weak certificate would break the “192-bit security minimum across the entire chain” guarantee.
The requirement applies to every certificate in the chain, not just the leaf certificate issued to the client or server. If the root CA or any intermediate CA uses a 2048-bit RSA key, the chain fails the 192-bit requirement even if the leaf certificate uses a 3072-bit key.
This is a frequently missed detail. Deploying a 4096-bit client certificate will not help if your root CA was issued with a 2048-bit key.
Why Does WPA3-Enterprise 192-Bit Require a 3072-Bit RSA Certificate?
The 192-bit security level maps to a minimum cryptographic strength defined in the NIST SP 800-57 security strength tables. The key detail is that RSA strength doesn’t scale linearly with key size:
| RSA key size | Approximate security strength |
| 2048-bit | ~112 bits |
| 3072-bit | ~128 bits |
| 4096-bit | ~140 bits |
4096 RSA strength is an estimation and not included in the NIST SP 800-57 security strength tables.
Notice that none of these RSA options reach 192-bit strength on their own. The WPA3 specification sets 3072 bits as the RSA minimum not because it hits 192 bits, but because it’s the smallest RSA key CNSA still considers acceptable alongside the other 192-bit-strength algorithms in the suite.
Those other algorithms are what carry the 192-bit claim. RSA-3072 (or ECDSA P-384) combined with AES-256-GCMP and HMAC-SHA-384 satisfies the overall 192-bit security level across the full suite — and a 2048-bit certificate breaks that assurance.
What EAP Method Is Required for WPA3-Enterprise 192-Bit Mode?
The only Extensible Authentication Protocol (EAP) method permitted under WPA3-Enterprise 192-bit mode is EAP-TLS.
PEAP-MSCHAPv2 and EAP-TTLS are not allowed. Both of those protocols rely on a username and password in Phase 2, which conflicts with the certificate-only authentication model the 192-bit mode enforces.
EAP-TLS performs mutual certificate authentication: The client presents a certificate to the Remote Authentication Dial-In User Service (RADIUS) server, and the RADIUS server presents a certificate to the client. Both must validate. This means the RADIUS server certificate also needs to meet the 3072-bit RSA or ECDSA P-384 requirement. A standard 2048-bit server certificate on the RADIUS side will cause the same failure.
The permitted TLS cipher suites for WPA3-Enterprise 192-bit mode are:
| Cipher Suite | Key Exchange | Authentication | Encryption |
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 | ECDHE P-384 | ECDSA P-384 | AES-256-GCM |
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | ECDHE P-384 | RSA ≥3072-bit | AES-256-GCM |
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | DHE ≥3072-bit | RSA ≥3072-bit | AES-256-GCM |
TLS 1.2 or TLS 1.3 is required. For TLS 1.3, the compatible cipher suite is TLS_AES_256_GCM_SHA384.
Does Windows 11 Support WPA3-Enterprise 192-Bit Mode?
Yes, but support came with conditions. Native support arrives at these versions:
- Windows 10: Version 2004 (build 19041) and later
- Windows Server: 2022 and later
- Windows 11: All versions, where it’s treated as a distinct authentication algorithm separate from WPA2-Enterprise
What changed more recently is how strictly Windows enforces the certificate requirements.
Many access point vendors and RADIUS implementations initially tolerated undersized certificates on 192-bit SSIDs. Windows has tightened enforcement, and Windows 11 clients on newer driver and OS builds will now reject a 2048-bit certificate on a WPA3-Enterprise 192-bit SSID.
This rejection surfaces as a failed 802.1X exchange with no useful error in most client-side logs — a live authentication break, not a warning. If you’re troubleshooting a silent connection failure on a 192-bit SSID, the certificate key size is the first thing to check.
Windows 11 version 24H2 also tightened EAP behavior more broadly. Users upgrading from Windows 10 or earlier Windows 11 builds to 24H2 have reported 802.1X authentication failures on networks that previously worked. Many of these failures trace back to certificate chain mismatches, server certificate validation changes, or RADIUS servers that do not support TLS 1.3.
If you deploy a WPA3-Enterprise 192-bit SSID in an environment with a mix of Windows 10 and Windows 11 clients, test certificate compatibility across both OS versions before rolling out.
| Skip the certificate chain headaches. |
| WPA3-Enterprise 192-bit mode fails silently when any certificate in the chain is undersized. See how SecureW2 issues the full chain at the right key size — and validates it with the required cipher suites — without on-premises PKI to rebuild. |
| Schedule a Demo → |
How Do I Configure WPA3-Enterprise on Windows?
Getting a WPA3-Enterprise 192-bit SSID working on Windows clients requires four things to be in place simultaneously:
- Access point configured for WPA3-Enterprise 192-bit mode: The SSID must use the WPA3ENT192 authentication type (GCMP-256 encryption). Access points on the 6 GHz band will require this mode because the Wi-Fi Alliance mandates WPA3 on 6 GHz; standard WPA2 is not permitted in that band.
- Client certificate issued with a 3072-bit or larger RSA key, or ECDSA P-384: This is where most deployments fail. The default key size in most CA web UIs is 2048 bits. You must explicitly request a larger key at issuance time.
- RADIUS server certificate also at 3072-bit RSA or ECDSA P-384: The RADIUS server must present a certificate that passes the 192-bit chain validation. JoinNow Cloud RADIUS from SecureW2 supports the required cipher suites and certificate configurations for 192-bit mode.
- Windows Wi-Fi profile configured for WPA3ENT192: The profile authentication value must be set to WPA3ENT192 with GCMP256 encryption. If you deploy via Intune using custom OMA-URI, confirm the profile specifies this authentication type explicitly.
For a broader reference on 802.1X authentication configuration, including profile deployment options, see SecureW2 protocol documentation.
How to Fix the Certificate Key Size: The MDM Override
In most Intune and Jamf deployments, the certificate key size is configured inside the mobile device management (MDM) platform’s certificate profile, not inside the CA web UI. That profile uses the Simple Certificate Enrollment Protocol (SCEP), which lets the requesting device specify the key size in its Certificate Signing Request (CSR).
So the CA web interface may show only 2048-bit as the default, but that default is irrelevant — the MDM controls what actually gets requested and issued.
When your SCEP profile specifies 4096 bits, the device generates a CSR for a 4096-bit key, the CA issues a 4096-bit certificate, and the client presents it to the RADIUS server. You don’t need to make a change to the CA configuration.
In Intune: Set the key size in the SCEP profile. Options are 1024, 2048, and 4096 bits — choose 4096 for RSA.
In Jamf Pro: Set the key size under the certificate payload settings in the SCEP configuration payload. Choose 4096 for RSA, or configure the profile to use ECC with P-384.
4096-bit RSA keys on Windows are stored in software (Software KSP), not the TPM — most TPMs don’t support 4096-bit key storage. If you need hardware-bound keys, use ECDSA P-384 instead. It delivers 192-bit-equivalent security with a smaller key the TPM can hold.
Brief History of WPA3-Enterprise 192-Bit Mode
WPA3-Enterprise 192-bit mode didn’t emerge in isolation; it arrived alongside WPA3 itself and only became widely relevant as newer Wi-Fi hardware forced the issue. Here’s how it all unfolded:
2017 — The KRACK (Key Reinstallation Attack) vulnerability is publicly disclosed, exposing weaknesses in WPA2 and accelerating pressure for a successor.
2018 — The Wi-Fi Alliance announces WPA3. WPA3-Personal introduces Simultaneous Authentication of Equals (SAE) to replace pre-shared keys, and WPA3-Enterprise brings enterprise authentication in line with modern cryptographic standards. 192-bit mode is included from the start, mapped to the CNSA Suite for classified and sensitive national security information — optional for most organizations, required only where CNSA-level obligations apply.
2021-2023 — Wi-Fi 6E is ratified and reaches commercial hardware, mandating WPA3 on all 6 GHz SSIDs and raising WPA3’s relevance across enterprise networks.
Today — As Wi-Fi 6E and Wi-Fi 7 hardware moves through normal refresh cycles, more deployments encounter 192-bit mode requirements for the first time — often without realizing it until authentication breaks.
6 GHz Wi-Fi and Why This Problem Is Getting More Common
Wi-Fi 6E and Wi-Fi 7 access points operate in the 6 GHz band. The Wi-Fi Alliance certification requirement for 6 GHz mandates WPA3. WPA2 is not permitted. For enterprise networks, this means any 6 GHz SSID must use WPA3-Enterprise. But “WPA3-Enterprise” and “WPA3-Enterprise 192-bit mode” aren’t the same requirement:
- Standard WPA3-Enterprise: What most 6 GHz deployments run, no 3072-bit certificate requirement
- 192-bit mode: An optional configuration that activates CNSA-level cryptographic requirements, including the strict certificate sizing this article covers
The certificate failures happen when the second one gets enabled — sometimes deliberately, sometimes not. High-security environments, government networks, and organizations aligned to NSA/CNSA standards are increasingly deploying 192-bit mode alongside 6 GHz APs. And as Wi-Fi 6E and Wi-Fi 7 hardware becomes the default enterprise refresh cycle, more admins will hit these requirements for the first time.
If you are bringing up 6 GHz radios on modern APs and activating WPA3-Enterprise 192-bit mode in the process, the certificate chain and RADIUS server configuration issues described in this article are what will block authentication before anything else.
On-Premises PKI and RADIUS vs. Cloud-Based Alternatives for WPA3-Enterprise 192-Bit Mode
Organizations deploying WPA3-Enterprise 192-bit mode have two infrastructure paths: on-premises CA and RADIUS server or a cloud-managed public key infrastructure (PKI) and RADIUS service.
On-Premises PKI and RADIUS
An on-premises Microsoft Active Directory Certificate Services (AD CS) deployment can issue 3072-bit or 4096-bit RSA certificates, but only if the certificate template is explicitly configured for that key size. The default templates in AD CS issue 2048-bit certificates. Admins need to duplicate the default template, change the minimum key size, and publish the new template before enrolling clients for a 192-bit mode deployment.
On the RADIUS side, a Microsoft Network Policy Server (NPS) deployment supports EAP-TLS but requires manual cipher suite configuration to ensure TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is enabled and preferred. NPS on older Windows Server builds may not support TLS 1.3, which can create authentication failures with Windows 11 24H2 clients.
The on-prem path requires ongoing attention as certificate standards change. When a root CA was originally issued with a 2048-bit key, replacing it to meet 192-bit mode requirements involves creating a new root CA, re-issuing all subordinate CAs, and re-enrolling all clients. That is a significant project for a large environment.
Cloud-Based PKI and RADIUS
A cloud-managed PKI designed for 802.1X deployments handles certificate chain configuration as part of the service setup. JoinNow Dynamic PKI builds the root and intermediate CA infrastructure at the specified key size from the start, so there is no legacy 2048-bit root CA to migrate away from.
Cloud RADIUS as a service removes the NPS cipher suite configuration requirement. The service handles the TLS negotiation and is updated to support new cipher suite requirements without requiring an admin to reconfigure a Windows server.
Comparing the Two Paths
For organizations deploying WPA3-Enterprise 192-bit mode for the first time, the cloud path avoids the most common failure points: legacy root CA key sizes and NPS cipher suite gaps.
| On-Premises (AD CS + NPS) | Cloud (Dynamic PKI + Cloud RADIUS) | |
| Certificate key size | Manual template configuration | Set at the specified size from setup |
| Legacy 2048-bit root CA | Requires full root CA migration | No legacy root to migrate |
| RADIUS cipher suites | Manual NPS configuration | Handled and updated by the service |
| TLS 1.3 support | Depends on Windows Server build | Maintained by the service |
How SecureW2 Handles WPA3-Enterprise 192-Bit Mode
Getting WPA3-Enterprise 192-bit mode right takes two things working together: a PKI that can issue certificates at the required key sizes across the entire chain, and a RADIUS service that supports the required cipher suites. SecureW2 handles both:
- JoinNow Dynamic PKI issues the certificates. It supports 3072-bit RSA, 4096-bit RSA, and ECDSA P-384 through its SCEP gateway. When your Intune or Jamf SCEP profile requests a given key size, the gateway issues at that spec — and the root and intermediate CAs are built for the full 192-bit chain requirements from the start.
- JoinNow Cloud RADIUS validates them. It supports the TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 cipher suites 192-bit mode requires. And because it integrates with Entra ID, Okta, and Google Workspace, you can enforce that only compliant, managed devices authenticate — a policy layer on top of the certificate requirements.
Both deploy without on-premises infrastructure: there’s no server to patch when cipher suite requirements change, and no hardware to replace when certificate standards evolve.
Schedule a demo to see how SecureW2 handles certificate issuance and RADIUS authentication for WPA3-Enterprise 192-bit mode.
Frequently Asked Questions
What is WPA3-Enterprise 192-bit mode?
WPA3-Enterprise 192-bit mode is a high-security operating mode for WPA3-Enterprise that enforces a minimum of 192 bits of security across the entire cryptographic chain. It requires EAP-TLS authentication, AES-256-GCMP encryption, and certificates with a minimum 3072-bit RSA or ECDSA P-384 key. It aligns with the NSA Commercial National Security Algorithm (CNSA) Suite.
How do I configure WPA3-Enterprise on Windows?
Deploy a Wi-Fi profile with the authentication type set to WPA3ENT192 and encryption set to GCMP256. Issue client and RADIUS server certificates at 3072-bit RSA or ECDSA P-384. If using Intune, set the key size in the SCEP profile to 4096 bits; the CA will issue at that size regardless of its web UI default. Verify the RADIUS server supports TLS 1.2 or TLS 1.3 with the required cipher suites.
Do all certificates in the chain need to be 3072-bit, or just the client certificate?
Every certificate in the chain must meet the requirement — the root CA, any intermediate CAs, the RADIUS server certificate, and the client certificate. The cipher rules apply to all certificates starting from the CA certificate, any intermediate certificates, and up to the client and server certificates. A single 2048-bit certificate anywhere in the chain, including a legacy root CA, breaks authentication. This is the most common cause of 192-bit mode failures, because admins often upgrade the leaf certificate while an old 2048-bit root remains in place.
Why does my certificate fail even though it's 3072-bit?
Key size isn't the only requirement. The certificate's signature algorithm must also be Suite B compliant — SHA-384 or SHA-512, not SHA-256. On Windows specifically, keys must be generated using a Cryptography Next Generation (CNG) compliant provider; legacy Cryptographic Service Provider (CSP) options don't support ECDSA P-384 or SHA-384 and will cause authentication failures. A correctly sized certificate with the wrong signature algorithm or generated by a legacy provider still won't work.
Should I use RSA or ECDSA certificates for 192-bit mode?
Both are permitted — RSA at 3072-bit or larger, or ECDSA on the P-384 curve. ECDSA P-384 is generally the better choice: it delivers equivalent security with a smaller key, and unlike 4096-bit RSA, its keys can be stored in a device's TPM for hardware binding. If you require hardware-bound keys, ECDSA P-384 is effectively the only option, since most TPMs don't support 4096-bit RSA key storage.
How do I migrate to 192-bit mode without breaking existing devices?
Use a parallel-SSID approach: stand up a new WPA3-Enterprise 192-bit SSID alongside your existing network and migrate devices gradually rather than converting in place. This lets you validate certificate compatibility on each device type before cutting over, and keeps legacy clients connected during the transition. Test across every OS version in your environment, since Windows 10 and Windows 11 24H2 enforce the requirements differently.
