So yes it looks like the &quot;LinkNYC Private&quot; network is indeed using full-blown WPA2-Enterprise IEEE 802.1X EAP-TLS w&#x2F; client certs.<p>It looks to be using Wi-Fi Passpoint &quot;online sign up&quot; (OSU) setup for client cert provisioning. Unfortunately, it does NOT look like it uses OSEN (WFA-UNAUTH-TLS type EAP-TLS) for the OSU WLAN, but instead chooses the option for an open OSU WLAN (using the same SSID as the non-private network) with a HTTPS captive portal. I would assume that this is the mechanism behind the reports of certificate downloads on iPhones.<p>LinkNYC and Hotspot 2.0:<p><a href="https:&#x2F;&#x2F;medium.com&#x2F;@LinkNYC&#x2F;secure-browsing-on-linknyc-s-wi-fi-networks-4b5d25329b5a" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;@LinkNYC&#x2F;secure-browsing-on-linknyc-s-wi-...</a><p><a href="https:&#x2F;&#x2F;www.globalreachtech.com&#x2F;deployments&#x2F;link-nyc&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.globalreachtech.com&#x2F;deployments&#x2F;link-nyc&#x2F;</a><p>Wi-Fi Passpoint aka Hotspot 2.0:<p><a href="https:&#x2F;&#x2F;www.wi-fi.org&#x2F;downloads-public&#x2F;Passpoint_R2_Deployment_Guidelines-v1%2B0.pdf&#x2F;13481" rel="nofollow">https:&#x2F;&#x2F;www.wi-fi.org&#x2F;downloads-public&#x2F;Passpoint_R2_Deployme...</a><p><a href="http:&#x2F;&#x2F;www.cisco.com&#x2F;c&#x2F;en&#x2F;us&#x2F;td&#x2F;docs&#x2F;wireless&#x2F;controller&#x2F;8-2&#x2F;config-guide&#x2F;b_cg82&#x2F;b_cg82_chapter_01101000.html" rel="nofollow">http:&#x2F;&#x2F;www.cisco.com&#x2F;c&#x2F;en&#x2F;us&#x2F;td&#x2F;docs&#x2F;wireless&#x2F;controller&#x2F;8-2...</a><p>Reports of cert provisioning:<p><a href="http:&#x2F;&#x2F;blog.alexflor.es&#x2F;post&#x2F;137705262900&#x2F;linknyc-secure-gigabit-hotspot" rel="nofollow">http:&#x2F;&#x2F;blog.alexflor.es&#x2F;post&#x2F;137705262900&#x2F;linknyc-secure-gig...</a><p><a href="http:&#x2F;&#x2F;www.engadget.com&#x2F;2016&#x2F;01&#x2F;19&#x2F;linknyc-gigabit-wifi-hands-on&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.engadget.com&#x2F;2016&#x2F;01&#x2F;19&#x2F;linknyc-gigabit-wifi-hand...</a>