nixos/wpa_supplicant: Broken EAP-TLS though wpa_supplicant

[GwendalBeaumont]

Nixpkgs version

• Unstable (26.05)

Describe the bug

I cannot connect to the eduroam Wi-Fi network of my university when attempting to use the CA Certificate. However, using GNOME's Settings Panel and turning on the No CA certificate is required checkbox, I am able to connect to the Wi-Fi.

Another experiment I did was switching from nixos-unstable to nixos-25.11 and I am able to connect to the eduroam network with CA Certificate enabled. So I'm guessing something must have broken in between 25.11 and unstable.

Steps to reproduce

• Setup a Wi-Fi connection with a CA Certificate
• Try to connect

Expected behaviour

NetworkManager connects to Wi-Fi.

Screenshots

No response

Relevant log output

12 Jan 08:38:25 wpa_supplicant: wlp0s20f3: EAP: Failed to initialize EAP method: vendor 0 method 25 (PEAP)
12 Jan 08:38:25 wpa_supplicant: wlp0s20f3: EAP: Failed to initialize EAP method: vendor 0 method 25 (PEAP)
12 Jan 08:38:25 wpa_supplicant: EAP-PEAP: Failed to initialize SSL.
12 Jan 08:38:25 wpa_supplicant: TLS: Failed to set TLS connection parameters
12 Jan 08:38:25 wpa_supplicant: OpenSSL: pending error: error:05880020:x509 certificate routines::BIO lib
12 Jan 08:38:25 wpa_supplicant: OpenSSL: pending error: error:10080002:BIO routines::system lib
12 Jan 08:38:25 wpa_supplicant: OpenSSL: tls_load_ca_der - Failed load CA in DER format error:80000002:system library::No such file or directory
12 Jan 08:38:25 wpa_supplicant: OpenSSL: pending error: error:05880020:x509 certificate routines::BIO lib
12 Jan 08:38:25 wpa_supplicant: OpenSSL: pending error: error:10000080:BIO routines::no such file
12 Jan 08:38:25 wpa_supplicant: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:80000002:system library::No such file or directory
12 Jan 08:38:25 wpa_supplicant: wlp0s20f3: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
12 Jan 08:38:25 kernel: wlp0s20f3: Limiting TX power to 17 dBm as advertised by 48:8b:0a:ba:a3:4e
12 Jan 08:38:25 wpa_supplicant: wlp0s20f3: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
12 Jan 08:38:25 kernel: wlp0s20f3: associated
12 Jan 08:38:25 wpa_supplicant: wlp0s20f3: CTRL-EVENT-EAP-STARTED EAP authentication started
12 Jan 08:38:25 wpa_supplicant: wlp0s20f3: Associated with 48:8b:0a:ba:a3:4e
12 Jan 08:38:25 kernel: wlp0s20f3: RX AssocResp from 48:8b:0a:ba:a3:4e (capab=0x1111 status=0 aid=1)
12 Jan 08:38:25 kernel: wlp0s20f3: associate with 48:8b:0a:ba:a3:4e (try 1/3)
12 Jan 08:38:25 kernel: wlp0s20f3: authenticated
12 Jan 08:38:25 wpa_supplicant: wlp0s20f3: Trying to associate with 48:8b:0a:ba:a3:4e (SSID='eduroam' freq=5560 MHz)

Additional context

No response

System metadata

• system: "x86_64-linux"
• host os: Linux 6.18.5, NixOS, 26.05 (Yarara), 26.05.20260113.1412caf
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.31.2+2
• nixpkgs: /nix/store/xh9wfbn9d64hmavam66yhl5vmkp0wi87-source

Notify maintainers

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

[GwendalBeaumont]

I installed openssl_3 system-wide, the error logs changed but the issue remains:

Jan 15 13:20:43 maple wpa_supplicant[1220]: wlp0s20f3: Trying to associate with 48:8b:0a:ba:a3:4e (SSID='eduroam' freq=5560 MHz)
Jan 15 13:20:43 maple kernel: wlp0s20f3: authenticated
Jan 15 13:20:43 maple kernel: wlp0s20f3: associate with 48:8b:0a:ba:a3:4e (try 1/3)
Jan 15 13:20:43 maple kernel: wlp0s20f3: associate with 48:8b:0a:ba:a3:4e (try 2/3)
Jan 15 13:20:43 maple kernel: wlp0s20f3: associate with 48:8b:0a:ba:a3:4e (try 3/3)
Jan 15 13:20:43 maple kernel: wlp0s20f3: association with 48:8b:0a:ba:a3:4e timed out
Jan 15 13:20:43 maple wpa_supplicant[1220]: wlp0s20f3: Added BSSID 48:8b:0a:ba:a3:4e into ignore list, ignoring for 10 seconds
Jan 15 13:20:43 maple wpa_supplicant[1220]: wlp0s20f3: BSSID 48:8b:0a:ba:a3:4e ignore list count incremented to 2, ignoring for 10 seconds
Jan 15 13:20:44 maple wpa_supplicant[1220]: wlp0s20f3: SME: Trying to authenticate with a0:0f:37:0d:07:ce (SSID='eduroam' freq=5320 MHz)
Jan 15 13:20:44 maple kernel: wlp0s20f3: authenticate with a0:0f:37:0d:07:ce (local address=hidden)
Jan 15 13:20:44 maple kernel: wlp0s20f3: send auth to a0:0f:37:0d:07:ce (try 1/3)
Jan 15 13:20:44 maple wpa_supplicant[1220]: wlp0s20f3: CTRL-EVENT-AUTH-REJECT a0:0f:37:0d:07:ce auth_type=0 auth_transaction=2 status_code=33 ie=dd05[...]
Jan 15 13:20:44 maple wpa_supplicant[1220]: wlp0s20f3: Added BSSID a0:0f:37:0d:07:ce into ignore list, ignoring for 10 seconds
Jan 15 13:20:44 maple wpa_supplicant[1220]: wlp0s20f3: BSSID a0:0f:37:0d:07:ce ignore list count incremented to 2, ignoring for 10 seconds
Jan 15 13:20:44 maple kernel: wlp0s20f3: a0:0f:37:0d:07:ce denied authentication (status 33)

[kenshineto]

I am also able to reproduce this issue, though installing openssl_3 system-wide for me did not resolve the OpenSSL tls errors in the wpa_supplicant logs. I also tried with a overlay, having wpa_supplicant be build with openssl_3 instead of openssl, and that did not fix the problem nor remove the tls error logs for me. :\

[kenshineto]

As far as I can tell, everyone using nixos unstable at my university is having this issue, and NONE of them can connect to our eduroam network.

[GwendalBeaumont]

Yes, as I figured out, this works fine with nixos-25.11 but stops working as soon as you're on unstable. My intuition says something happened to wpa_supplicant between 4fc98df and 5e9a993 but this is only intuition and may not be relevant at all.

[YvesStraten]

Same thing here... I am unfortunately completely unable to connect to my university's eduroam on unstable.

[YvesStraten]

Update: downgrading to stable did absolutely nothing for me unfortunately.

[GwendalBeaumont]

Uh, interesting, what do your logs look like? Do you get the same error as I have?

[YvesStraten]

Uh, interesting, what do your logs look like? Do you get the same error as I have?

Here are the logs. My config is available here. I could not push yet, as me not being on eduroam prevents me from pushing anything to my repos.

jan 21 10:56:39 nixos wpa_supplicant[2311]: wlo1: SME: Trying to authenticate with 00:fc:ba:7b:c7:c0 (SSID='eduroam' freq=2437 MHz)
jan 21 10:56:39 nixos kernel: wlo1: authenticate with 00:fc:ba:7b:c7:c0 (local address=98:bd:80:34:6f:43)
jan 21 10:56:39 nixos kernel: wlo1: send auth to 00:fc:ba:7b:c7:c0 (try 1/3)
jan 21 10:56:39 nixos wpa_supplicant[2311]: wlo1: Trying to associate with 00:fc:ba:7b:c7:c0 (SSID='eduroam' freq=2437 MHz)
jan 21 10:56:39 nixos kernel: wlo1: authenticated
jan 21 10:56:39 nixos kernel: wlo1: associate with 00:fc:ba:7b:c7:c0 (try 1/3)
jan 21 10:56:39 nixos kernel: wlo1: RX AssocResp from 00:fc:ba:7b:c7:c0 (capab=0x1411 status=0 aid=1)
jan 21 10:56:39 nixos wpa_supplicant[2311]: wlo1: Associated with 00:fc:ba:7b:c7:c0
jan 21 10:56:39 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-EAP-STARTED EAP authentication started
jan 21 10:56:39 nixos kernel: wlo1: associated
jan 21 10:56:39 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
jan 21 10:56:39 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
jan 21 10:56:39 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-EAP-PEER-CERT depth=1 subject='/C=SE/ST=Kronoberg/O=LNU/OU=IT/CN=Linnaeus University/emailAddress=os-infrait@lnu.se' hash=3c153e6c1c33c0ce5f9ef5a42bdd56429ac3959ae827ea41ab7cd27d824e4867
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/C=SE/ST=Kronoberg/L=Vaxjo/O=LNU/CN=eduroam.lnu.se' hash=e12e06ef6509a67a9ee46cb16e56c2a45d6c7c2b113e0ac16ed3f3b8f98b1337
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-EAP-PEER-ALT depth=0 DNS:eduroam.lnu.se
jan 21 10:56:40 nixos wpa_supplicant[2311]: TLS: Certificate verification failed, error 2 (unable to get issuer certificate) depth 1 for '/C=SE/ST=Kronoberg/O=LNU/OU=IT/CN=Linnaeus University/emailAddress=os-infrait@lnu.se'
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-EAP-TLS-CERT-ERROR reason=1 depth=1 subject='/C=SE/ST=Kronoberg/O=LNU/OU=IT/CN=Linnaeus University/emailAddress=os-infrait@lnu.se' err='unable to get issuer certificate'
jan 21 10:56:40 nixos wpa_supplicant[2311]: SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA
jan 21 10:56:40 nixos wpa_supplicant[2311]: OpenSSL: openssl_handshake - SSL_connect error:0A000086:SSL routines::certificate verify failed
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-EAP-FAILURE EAP authentication failed
jan 21 10:56:40 nixos kernel: wlo1: deauthenticated from 00:fc:ba:7b:c7:c0 (Reason: 23=IEEE8021X_FAILED)
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-DISCONNECTED bssid=00:fc:ba:7b:c7:c0 reason=23
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="eduroam" auth_failures=1 duration=10 reason=AUTH_FAILED
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: Added BSSID 00:fc:ba:7b:c7:c0 into ignore list, ignoring for 10 seconds
jan 21 10:56:40 nixos wpa_supplicant[2311]: wlo1: BSSID 00:fc:ba:7b:c7:c0 ignore list count incremented to 2, ignoring for 10 seconds

[YvesStraten]

I will try next week with a nixos usb stick, cause I am starting to feel that my installation might be unstable/corrupt.

[GwendalBeaumont]

Yes, given this line:

jan 21 10:56:40 nixos wpa_supplicant[2311]: OpenSSL: openssl_handshake - SSL_connect error:0A000086:SSL routines::certificate verify failed

I am assuming something is wrong on the verification side. This might be related to this issue or something completely different.

[dhwisema]

I and other students at my university are also having issues with eduroam
though our errors look different

Error: Connection activation failed: Secrets were required, but not provided
Hint: use 'journalctl -xe NM_CONNECTION=6c25e4bd-c36e-4bf6-80cb-62cab1da0d1a + NM_DEVICE=wlp6s0' to get more details.

output of ournalctl -xe NM_CONNECTION=6c25e4bd-c36e-4bf6-80cb-62cab1da0d1a + NM_DEVICE=wlp6s0

Jan 22 19:53:03 Beau NetworkManager[1465]: <warn>  [1769129583.4447] device (wlp6s0): no secrets: No agents were available for this request.
Jan 22 19:53:03 Beau NetworkManager[1465]: <warn>  [1769129583.4600] device (wlp6s0): Activation: failed for connection 'eduroam [63cdaa00]'
Jan 22 20:00:51 Beau NetworkManager[1465]: <warn>  [1769130051.5073] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:00:53 Beau NetworkManager[1465]: <warn>  [1769130053.4961] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:00:55 Beau NetworkManager[1465]: <warn>  [1769130055.5114] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:00:59 Beau NetworkManager[1465]: <warn>  [1769130059.5379] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:01 Beau NetworkManager[1465]: <warn>  [1769130061.5547] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:03 Beau NetworkManager[1465]: <warn>  [1769130063.5713] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:05 Beau NetworkManager[1465]: <warn>  [1769130065.5866] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:07 Beau NetworkManager[1465]: <warn>  [1769130067.6025] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:09 Beau NetworkManager[1465]: <warn>  [1769130069.6187] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:11 Beau NetworkManager[1465]: <warn>  [1769130071.6339] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:13 Beau NetworkManager[1465]: <warn>  [1769130073.6498] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:15 Beau NetworkManager[1465]: <warn>  [1769130075.6668] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:41 Beau NetworkManager[1465]: <warn>  [1769130101.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:01:41 Beau NetworkManager[1465]: <warn>  [1769130101.1849] device (wlp6s0): Activation: (wifi) asking for new secrets
Jan 22 20:02:06 Beau NetworkManager[1465]: <warn>  [1769130126.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:02:06 Beau NetworkManager[1465]: <warn>  [1769130126.1848] device (wlp6s0): Activation: (wifi) asking for new secrets
Jan 22 20:02:31 Beau NetworkManager[1465]: <warn>  [1769130151.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:02:31 Beau NetworkManager[1465]: <warn>  [1769130151.2042] device (wlp6s0): Activation: failed for connection 'eduroam [6c25e4bd]'
Jan 22 20:09:24 Beau NetworkManager[1465]: <warn>  [1769130564.4118] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:09:54 Beau NetworkManager[1465]: <warn>  [1769130594.1848] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:09:54 Beau NetworkManager[1465]: <warn>  [1769130594.1849] device (wlp6s0): Activation: (wifi) asking for new secrets
Jan 22 20:10:19 Beau NetworkManager[1465]: <warn>  [1769130619.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:10:19 Beau NetworkManager[1465]: <warn>  [1769130619.1848] device (wlp6s0): Activation: (wifi) asking for new secrets
Jan 22 20:10:44 Beau NetworkManager[1465]: <warn>  [1769130644.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:10:44 Beau NetworkManager[1465]: <warn>  [1769130644.2062] device (wlp6s0): Activation: failed for connection 'eduroam [6c25e4bd]'

my output of journalctl --unit wpa_supplicant --since "10 minutes ago"

Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:80000002:system library::No such file or directory
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: pending error: error:10000080:BIO routines::no such file
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: pending error: error:05880020:x509 certificate routines::BIO lib
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: tls_load_ca_der - Failed load CA in DER format error:80000002:system library::No such file or directory
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: pending error: error:10080002:BIO routines::system lib
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: pending error: error:05880020:x509 certificate routines::BIO lib
Jan 22 20:09:57 Beau wpa_supplicant[940]: TLS: Failed to set TLS connection parameters
Jan 22 20:09:57 Beau wpa_supplicant[940]: EAP-TLS: Failed to initialize SSL.
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS)
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-EAP-FAILURE EAP authentication failed
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-DISCONNECTED bssid=50:e4:e0:71:44:10 reason=23
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="eduroam" auth_failures=1 duration=10 reason=AUTH_FAILED
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: Added BSSID 50:e4:e0:71:44:10 into ignore list, ignoring for 10 seconds
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: BSSID 50:e4:e0:71:44:10 ignore list count incremented to 2, ignoring for 10 seconds
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="eduroam" auth_failures=2 duration=34 reason=CONN_FAILED
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: Removed BSSID 50:e4:e0:71:44:10 from ignore list (clear)
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: SME: Trying to authenticate with 50:e4:e0:71:44:10 (SSID='eduroam' freq=5180 MHz)
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: Trying to associate with 50:e4:e0:71:44:10 (SSID='eduroam' freq=5180 MHz)
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: Associated with 50:e4:e0:71:44:10
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
Jan 22 20:10:22 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-EAP-STARTED EAP authentication started
Jan 22 20:10:22 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=13
Jan 22 20:10:22 Beau wpa_supplicant[940]: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:80000002:system library::No such file or directory
Jan 22 20:10:22 Beau wpa_supplicant[940]: OpenSSL: pending error: error:10000080:BIO routines::no such file

[dhwisema]

I and other students at my university are also having issues with eduroam though our errors look different

Error: Connection activation failed: Secrets were required, but not provided Hint: use 'journalctl -xe NM_CONNECTION=6c25e4bd-c36e-4bf6-80cb-62cab1da0d1a + NM_DEVICE=wlp6s0' to get more details.

output of ournalctl -xe NM_CONNECTION=6c25e4bd-c36e-4bf6-80cb-62cab1da0d1a + NM_DEVICE=wlp6s0

Jan 22 19:53:03 Beau NetworkManager[1465]: <warn>  [1769129583.4447] device (wlp6s0): no secrets: No agents were available for this request.
Jan 22 19:53:03 Beau NetworkManager[1465]: <warn>  [1769129583.4600] device (wlp6s0): Activation: failed for connection 'eduroam [63cdaa00]'
Jan 22 20:00:51 Beau NetworkManager[1465]: <warn>  [1769130051.5073] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:00:53 Beau NetworkManager[1465]: <warn>  [1769130053.4961] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:00:55 Beau NetworkManager[1465]: <warn>  [1769130055.5114] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:00:59 Beau NetworkManager[1465]: <warn>  [1769130059.5379] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:01 Beau NetworkManager[1465]: <warn>  [1769130061.5547] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:03 Beau NetworkManager[1465]: <warn>  [1769130063.5713] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:05 Beau NetworkManager[1465]: <warn>  [1769130065.5866] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:07 Beau NetworkManager[1465]: <warn>  [1769130067.6025] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:09 Beau NetworkManager[1465]: <warn>  [1769130069.6187] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:11 Beau NetworkManager[1465]: <warn>  [1769130071.6339] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:13 Beau NetworkManager[1465]: <warn>  [1769130073.6498] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:15 Beau NetworkManager[1465]: <warn>  [1769130075.6668] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:01:41 Beau NetworkManager[1465]: <warn>  [1769130101.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:01:41 Beau NetworkManager[1465]: <warn>  [1769130101.1849] device (wlp6s0): Activation: (wifi) asking for new secrets
Jan 22 20:02:06 Beau NetworkManager[1465]: <warn>  [1769130126.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:02:06 Beau NetworkManager[1465]: <warn>  [1769130126.1848] device (wlp6s0): Activation: (wifi) asking for new secrets
Jan 22 20:02:31 Beau NetworkManager[1465]: <warn>  [1769130151.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:02:31 Beau NetworkManager[1465]: <warn>  [1769130151.2042] device (wlp6s0): Activation: failed for connection 'eduroam [6c25e4bd]'
Jan 22 20:09:24 Beau NetworkManager[1465]: <warn>  [1769130564.4118] device (wlp6s0): Deactivation failed: GDBus.Error:fi.w1.wpa_supplicant1.NotConnected: This interface is not connected
Jan 22 20:09:54 Beau NetworkManager[1465]: <warn>  [1769130594.1848] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:09:54 Beau NetworkManager[1465]: <warn>  [1769130594.1849] device (wlp6s0): Activation: (wifi) asking for new secrets
Jan 22 20:10:19 Beau NetworkManager[1465]: <warn>  [1769130619.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:10:19 Beau NetworkManager[1465]: <warn>  [1769130619.1848] device (wlp6s0): Activation: (wifi) asking for new secrets
Jan 22 20:10:44 Beau NetworkManager[1465]: <warn>  [1769130644.1847] device (wlp6s0): Activation: (wifi) association took too long
Jan 22 20:10:44 Beau NetworkManager[1465]: <warn>  [1769130644.2062] device (wlp6s0): Activation: failed for connection 'eduroam [6c25e4bd]'

my output of journalctl --unit wpa_supplicant --since "10 minutes ago"

Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:80000002:system library::No such file or directory
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: pending error: error:10000080:BIO routines::no such file
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: pending error: error:05880020:x509 certificate routines::BIO lib
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: tls_load_ca_der - Failed load CA in DER format error:80000002:system library::No such file or directory
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: pending error: error:10080002:BIO routines::system lib
Jan 22 20:09:57 Beau wpa_supplicant[940]: OpenSSL: pending error: error:05880020:x509 certificate routines::BIO lib
Jan 22 20:09:57 Beau wpa_supplicant[940]: TLS: Failed to set TLS connection parameters
Jan 22 20:09:57 Beau wpa_supplicant[940]: EAP-TLS: Failed to initialize SSL.
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: EAP: Failed to initialize EAP method: vendor 0 method 13 (TLS)
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-EAP-FAILURE EAP authentication failed
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-DISCONNECTED bssid=50:e4:e0:71:44:10 reason=23
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="eduroam" auth_failures=1 duration=10 reason=AUTH_FAILED
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: Added BSSID 50:e4:e0:71:44:10 into ignore list, ignoring for 10 seconds
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: BSSID 50:e4:e0:71:44:10 ignore list count incremented to 2, ignoring for 10 seconds
Jan 22 20:09:57 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="eduroam" auth_failures=2 duration=34 reason=CONN_FAILED
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: Removed BSSID 50:e4:e0:71:44:10 from ignore list (clear)
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: SME: Trying to authenticate with 50:e4:e0:71:44:10 (SSID='eduroam' freq=5180 MHz)
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: Trying to associate with 50:e4:e0:71:44:10 (SSID='eduroam' freq=5180 MHz)
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: Associated with 50:e4:e0:71:44:10
Jan 22 20:10:20 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
Jan 22 20:10:22 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-EAP-STARTED EAP authentication started
Jan 22 20:10:22 Beau wpa_supplicant[940]: wlp6s0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=13
Jan 22 20:10:22 Beau wpa_supplicant[940]: OpenSSL: tls_connection_ca_cert - Failed to load root certificates error:80000002:system library::No such file or directory
Jan 22 20:10:22 Beau wpa_supplicant[940]: OpenSSL: pending error: error:10000080:BIO routines::no such file

Also do want to note that tried to replicate this in the fedora 43 workstation live iso and was able to connect to eduroam successfully

[Booster884]

This issue is probably related to #427528, as the corresponding comment in the breaking changes thread notes that certificates should be made accessible to the wpa_supplicant user. The setup script given by my university (probably like most others) puts the CA certificate somewhere under my home directory, which wpa_supplicant can't access.

Solving this would involve manually copying the certificate file over to /etc/wpa_supplicant/ and running chown wpa_supplicant on it as advised. That said I haven't tried this myself (and won't be able to for a while), so if someone can say if it helped that would be nice!