Wi-Fi Provisioning Configuration Generator

This tool generates Protocol Buffers (protobuf) configuration messages for Wi-Fi® provisioning, supporting both EAP-TLS (Enterprise) and Personal (WPA2-PSK/WPA3-PSK) modes.

Prerequisites 

The script automatically generates its own protobuf dependencies when needed. No manual setup is required.

Note

The script requires the protoc compiler to be available in your PATH. This is typically included in the NCS toolchain.

Usage 

The script supports two main modes:

Enterprise mode 

Run the following command for enterprise networks using certificate-based authentication, EAP-TLS is used as an example:

python3 generate_wifi_prov_config.py "MyWi-Fi" "AA:BB:CC:DD:EE:FF" \
    -d /path/to/certs \
    -j -o eap_tls_config.json

The following are the required certificate files in the cert directory:

ca.pem - CA certificate
client.pem - Client certificate
client-key.pem - Client private key
ca2.pem - Secondary CA certificate
client2.pem - Secondary client certificate
client-key2.pem - Secondary client private key

Personal mode 

Run the following commands for home or office networks using passphrase authentication:

# WPA2-PSK
python3 generate_wifi_prov_config.py "MyWi-Fi" "AA:BB:CC:DD:EE:FF" \
    -w "mypassword" -a 3 -j -o personal_config.json

# WPA3-SAE
python3 generate_wifi_prov_config.py "MyWi-Fi" "AA:BB:CC:DD:EE:FF" \
    -w "mypassword" -a 10 -j -o wpa3_config.json

Command line options 

Command-line arguments
Argument	Description	Default values and notes
`ssid`	Wi-Fi network name	(positional)
`bssid`	Wi-Fi BSSID (MAC address)	(positional)
`-d, --cert-dir`	Certificate directory (for EAP-TLS mode)	(optional)
`-w, --passphrase`	Wi-Fi passphrase (for Personal mode)	(optional)
`-a, --auth-mode`	Authentication mode	0=OPEN, 1=WEP, 2=WPA_PSK, 3=WPA2_PSK, 4=WPA_WPA2_PSK, 5=WPA2_ENTERPRISE, 6=WPA3_PSK, 7=NONE, 8=PSK, 9=PSK_SHA256, 10=SAE, 11=WAPI, 12=EAP, 13=WPA_AUTO_PERSONAL, 14=DPP, 15=EAP_PEAP_MSCHAPV2, 16=EAP_PEAP_GTC, 17=EAP_TTLS_MSCHAPV2, 18=EAP_PEAP_TLS, 19=FT_PSK, 20=FT_SAE, 21=FT_EAP, 22=FT_EAP_SHA384, 23=SAE_EXT_KEY; default: 5=WPA2_ENTERPRISE
`-c, --channel`	Wi-Fi channel	default: 0
`-b, --band`	Wi-Fi band	0=AUTO, 1=2.4GHz, 2=5GHz; default: 0
`-i, --identity`	EAP identity	default: user@example.com
`-p, --password`	EAP password	default: user_password
`-k, --private-key-passwd`	Primary private key password	(optional)
`-k2, --private-key-passwd2`	Secondary private key password	(optional)
`-o, --output`	Output file	(optional)
`-j, --json`	Display JSON configuration	(optional)