Wifi WPA Enterprise - In android 11 under 'Online Certificate Status', what is the difference between the various options? Recently I noticed that my Note 10 would no longer associate with my wifi but all other phones would.  I have since resolved the issue by rerolling my certificates but cannot get the options 'Require status for all certificates' or 'Require status for untrusted certificates' to work.  'Request Status' does work as well as 'Don't validate'
'Require status for all certificates' fails with on the freeradius end with -
(36) eap: Expiring EAP session with state 0xb8be52eabb005f50
(36) eap: Finished EAP session with state 0xb8be52eabb005f50
(36) eap: Previous EAP request found for state 0xb8be52eabb005f50, released from the list
(36) eap: Peer sent packet with method EAP TLS (13)
(36) eap: Calling submodule eap_tls to process data
(36) eap_tls: Continuing EAP-TLS
(36) eap_tls: [eaptls verify] = ok
(36) eap_tls: Done initial handshake
(36) eap_tls: &lt;&lt;&lt; recv TLS 1.1  [length 0002]
(36) eap_tls: ERROR: TLS Alert read:fatal:internal error
(36) eap_tls: TLS_accept: Need to read more data: error
(36) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
(36) eap_tls: TLS - In Handshake Phase
(36) eap_tls: TLS - Application data.
(36) eap_tls: ERROR: TLS failed during operation
(36) eap_tls: ERROR: [eaptls process] = fail
(36) eap: ERROR: Failed continuing EAP TLS (13) session.  EAP sub-module failed
(36) eap: Sending EAP Failure (code 4) ID 190 length 4

'Require status for untrusted' hangs with android eventually giving up with this on the freeradius end -
(5) eap_tls: [eaptls start] = request
(5) eap: Sending EAP Request (code 1) ID 243 length 6
(5) eap: EAP session adding &amp;reply:State = 0xcff1ecc3cf02e118
(5)     [eap] = handled
(5)   } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) Post-Auth-Type sub-section not found.  Ignoring.
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5) Sent Access-Challenge Id 247 from 192.168.45.251:1812 to 192.168.45.37:33524 length 0
(5)   EAP-Message = 0x01f300060d20
(5)   Message-Authenticator = 0x00000000000000000000000000000000
(5)   State = 0xcff1ecc3cf02e118ed54fc1c4b664912
(5) Finished request
Waking up in 4.9 seconds.
(5) Cleaning up request packet ID 247 with timestamp +19
Ready to process requests

What do I need to implement or correct so these two options will work as well?
&quot;Certificate status request&quot; is the official TLS terminology for OCSP stapling.
The Android option is very likely a direct mapping to the corresponding wpa_supplicant option (just like the &quot;Domain&quot; field is domain_suffix_match, and so on).