Automation Transforms $70 APs into Enterprise-Grade Networks#

Henry Haller, Telecom Infrastructure Project (TIP) OpenWiFi

• Why: Under the WLAN packaging, this is one of the few sessions about device identity at fleet scale — per-device certificate generation, CA signing, and mutual TLS between controller and devices, i.e., the bootstrapping problem familiar from SPIFFE/SPIRE workload identity, applied to hardware.
• What: An open-source lifecycle system (TIP OpenWiFi) that takes commodity $70 access points from zero-touch adoption to provisioned enterprise WLANs, covering WPA⅔, PSK/mPSK-RADIUS, OWE, GRE tunneling, and multi-band configs.
• How: WAPs generate SSL certificates on adoption and submit them to a CA for signing; the certificates then authenticate the devices to the OpenWiFi Gateway via mutual TLS, creating a web of trust, with CA management included. Provisioning is driven by operator intent via JSON API transactions to the gateway and WebSocket transactions from gateway to APs. The source slides add operational lessons: immediate UI feedback and robust logging/error reporting matter because end-user feedback arrives late and through many layers.
• Where applicable: The software is TIP OpenWiFi-specific, but the onboarding pattern — device-generated keys, CA signing, mTLS control channel — is the template for any commodity-hardware fleet (including cameras, sensors, and DC out-of-band gear).