This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use any 5S® Service and tells You about Your privacy rights and how the law protects You. Interpretation and Definitions. The

<main id="isPasted">This Privacy Policy describes Our policies and procedures on the collection, use and disclosure of Your information when You use any 5S&#xAE; Service and tells You about Your privacy rights and how the law protects You.Interpretation and Definitions<h2 id="interpretation">Interpretation</h2>The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.<h2 id="definitions">Definitions</h2>For the purposes of this Privacy Policy:Account means a unique account created for You to access our Service or parts of our Service.Affiliate means an entity that controls, is controlled by or is under common control with a party, where &quot;control&quot; means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.Application means the software program provided by the Company downloaded by You on any electronic device, named 5S&#xAE;Company (referred to as either &quot;the Company&quot;, &quot;We&quot;, &quot;Us&quot; or &quot;Our&quot; in this Agreement) refers to OpticWise, Inc., 619 12th Street #1134, Golden, CO 80401.Country refers to: Colorado, United StatesDevice means any device that can access the Service such as a computer, a cellphone or a digital tablet.Personal Data is any information that relates to an identified or identifiable individual.Service refers to the Application.Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.Collecting and Using Your Personal Data<h2 id="types-of-data-collected">Types of Data Collected</h2><h3 id="personal-data">Personal Data</h3>While using Our 5S&#xAE; Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. Personally identifiable information is limited to:Email addressFirst name and last namePhone number<h3 id="usage-data">Usage Data</h3>Device Usage Data is collected automatically when using the Service.Device Usage Data is utilized for connectivity support purposes only. This may include information such as Your Device&apos;s Internet Protocol address (e.g. IP address) on the network, the time and date of Your usage of the Service, unique device identifiers and other diagnostic data.We do not collect information that Your browser sends whenever You access the Service by or through a mobile device.<h2 id="use-of-your-personal-data">Use of Your Personal Data</h2>The Company may use Personal Data for the following purposes:To provide and maintain our Service, including to monitor the usage of our Service.To manage Your Account: to manage Your registration as a user of the Service.To contact You: To contact You by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as a mobile application&apos;s push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including the security updates, when necessary or reasonable for their implementation.To manage Your requests: To attend and manage Your requests to Us.We do not share Your personal information ever, particularly in the following situations:<ul><li>With Service Providers</li><li>With Affiliates</li><li>With business partners</li><li>With other users</li></ul><h2 id="retention-of-your-personal-data">Retention of Your Personal Data</h2>The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.The Company will not retain Usage Data.&#xA0;<h2 id="disclosure-of-your-personal-data">Disclosure of Your Personal Data</h2><h3 id="business-transactions">Business Transactions</h3>If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.<h3 id="law-enforcement">Law enforcement</h3>Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).<h3 id="other-legal-requirements">Other legal requirements</h3>The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:<ul><li>Comply with a legal obligation</li><li>Protect and defend the rights or property of the Company</li><li>Prevent or investigate possible wrongdoing in connection with the Service</li><li>Protect the personal safety of Users of the Service or the public</li><li>Protect against legal liability</li></ul><h2 id="security-of-your-personal-data">Security of Your Personal Data</h2>The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.Links to Other WebsitesOur Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party&apos;s site. We strongly advise You to review the Privacy Policy of every site You visit.We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.Changes to this Privacy PolicyWe may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page.We will let You know via email and/or a prominent notice on Our Service, prior to the change becoming effective and update the &quot;Last updated&quot; date at the top of this Privacy Policy.You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.Contact UsIf you have any questions about this Privacy Policy, You can contact us:<ul><li>By email: support@opticwise.com</li></ul></main>

5S® User Ultimate Privacy Policy

This document explains why we use Enterprise Wi-Fi with a private certificate authority (CA) in order to securely join client devices to our network. The audience should include any users who manage the settings on their own Wi-Fi client devices, IT

<section id="isPasted"><h1 id="audience">Audience</h1>This document explains why we use Enterprise Wi-Fi with a private certificate authority (CA) in order to securely join client devices to our network. The audience should include any users who manage the settings on their own Wi-Fi client devices, IT admins who manage these settings on behalf of users, or at larger companies, Mobile Device Management system admins who understand the concepts and want to validate our design.<section><h1 id="5s-wi-fi-networks">5S&#xAE; Wi-Fi Networks</h1><ul><li style="font-size: 16px;">Primary tenant network:&#xA0;<ul><li style="font-size: 16px;">Name: EngineWorks&#xA0;5S Main</li><li style="font-size: 16px;">Security: Enterprise certificate-backed with per-user credentials</li></ul></li><li style="font-size: 16px;">IoT tenant network:&#xA0;<ul><li style="font-size: 16px;">Name: EngineWorks&#xA0;5S IoT</li><li style="font-size: 16px;">Security: Per-device MAC allowlist, plus WPA2-AES preshared key</li><li style="font-size: 16px;">intended for tenants&apos; devices that cannot handle username-based Enterprise security</li></ul></li><li style="font-size: 16px;">Guest network:&#xA0;<ul><li style="font-size: 16px;">Name: EngineWorks&#xA0;5S Guest </li><li style="font-size: 16px;">Security: WPA2-AES preshared key which rotates weekly</li><li style="font-size: 16px;">intended only for transient guest devices</li></ul></li></ul>For more information, refer to the &quot;Wi-Fi Networks...&quot; help center article.<section><section><section><section> </section></section></section></section></section><h1 id="enterprise-wi-fi">Enterprise Wi-Fi</h1>The primary Wi-Fi network uses enterprise level Wi-Fi authentication to maximize user security.&#xA0;Like most Wi-Fi networks, we broadcast our network name in order to make it easy for users to locate and connect to it. This name is technically known as its SSID and is chosen to be user-friendly and consistent with the branding needs of the network owner and operator.There is no authority regulating which SSIDs may be used by which organizations or in which locations. As such, nothing prevents someone from creating an unauthorized/conflicting network with the same name as ours. Someone might do this by accident, or an attacker might do it on purpose to trick users into connecting to the wrong network in order to intercept their communications or steal their credentials. An attacker could even spoof this network at other locations where targeted users are expected to travel, such as a nearby cafe where users might go for lunch. In such a case it is unlikely that we would ever be able to detect and disable the spoofed network.To mitigate this type of network spoofing threat, we secure the network using WPA2-Enterprise security (and coming soon, WPA3-Enterprise), in which a digital certificate securely identifies the Wi-Fi authentication server and enables strong encryption on connections between Wi-Fi devices and the network.Properly configured user devices will not automatically connect to such impostor networks. See &quot;Validating Enterprise Wi-Fi Certificates&quot; for details on properly configuring devices. In cases where users are expected to validate the certificates, these documents may be used as a basis for user training material.&#xA0;<h1 id="public-versus-private-certificates">Public versus Private Certificates</h1>The following sections discuss why the web uses public CAs, but our Enterprise Wi-Fi uses a private CA.<h2 id="public-cas-and-the-web">Public CAs and the Web</h2>The web involves large and constantly changing sets of web sites and applications, users, and client devices. These parties typically have no practical way to directly share identity information in order to authenticate each other. So a system of third party authorities was created to perform this identity verification function.These third party authorities are organizations known as Public CAs and will provide (for a fee) digital certificates that attest to the identity of a web site or application, or even users. These certificates have short lifetimes, currently limited to about 1 year maximum.Public CAs must abide by rules defined by the CA/Browser Forum and pass their stringent audits in order to have their own digital certificates designated as trusted root certificates and pre-loaded into major operating systems like Microsoft Windows, Apple macOS, Apple iOS, Android, and Linux, or directly into web browser applications like Mozilla Firefox, Google Chrome, Apple Safari, and Microsoft Edge.These pre-loaded Public CA certificates enable your web browsers and other applications on your computer, smartphone, or tablet to claim with high confidence that they are securely connected to a specific web site such as your bank, and that any communications with that site are secure and private.If a Public CA violates the rules established by the CA/Browser Forum, then their root certificates may be invalidated in all the operating systems and browsers, which would cause the certificates they signed to become untrusted, and the web services protected by those certificates to stop working. Users would be upset, as would the web service operators who paid for those certificates.One of these rules is that certificates must identify a formalized identity such as an Internet domain name, and can only be provided to a requestor who proves they ownership or control of that identity. Domain names are tightly controlled by a formal system of regulated Domain Name Registries and Registrars. Another rule is that digital certificates may have a maximum limited lifetime, currently about 1 year, after which they expire and can no longer be trusted.<h2 id="private-cas-and-wi-fi">Private CAs and Wi-Fi</h2>Wi-Fi networks are significantly different from web services, and these differences make Public CAs less useful for securing Wi-Fi networks.In most cases, Wi-Fi networks have local scope that can be measured in feet, sometimes miles. Identity information is normally shared directly between the operator and the users. Third party authorities are rarely useful.Some Wi-Fi networks can arguably tolerate more risk than web services, because they generally provide short haul additional encryption on top of traffic that is already encrypted to the more stringent web standards.Wi-Fi networks also have no central naming authority, and the names may be free-form and need not follow the format rules for Internet domain names. Wi-Fi network operators will often choose user-friendly SSIDs that fit their brand, school, or family identity or anything at all. The Public CA system can&apos;t authenticate ownership or even issue certificates that cover these free-form names.Different types of Wi-Fi clients have a wide variety of procedures for validating Enterprise Wi-Fi certificates, many of which require the users or their company IT administrators to perform the validation.Normally, organizations that operate an Enterprise Wi-Fi networks also operate at least one internal private CA, and directly control the Wi-Fi clients that are allowed to connect to the network. In such cases, adding a third party Public CA would likely reduce security. We are unaware of any Wi-Fi clients that currently require Public CAs, and doubt that clients will do so in future.Most current Wi-Fi clients do not even consider whether the Wi-Fi network name matches the certificate subject when validating certificates. Even if a Wi-Fi network happens to use a valid Internet domain name and has a certificate signed by a Public CA, clients often ignore this. As such, there is no clear security advantage to using a Public CA certificate for Wi-Fi.But there are still risks that need to be mitigated. Since anyone can spoof our Wi-Fi network and attempt to trick clients into connecting to it as a preliminary setup for attempting other types of attacks, it is important for us to give users a reliable way to authenticate to the Wi-Fi network.Based on these requirements and considerations, we have chosen to use certificates generated by our own private CA, and distribute the certificates through our support portal. Please see &quot;Validating Enterprise Wi-Fi Certificates&quot; for our certificates and detailed instructions.</section>

Enterprise Wi-Fi Authentication and Certificates

The main 5S® tenant Wi-Fi network at EngineWorks Bozeman is:. EngineWorks 5S Main. The main 5S® tenant Wi-Fi network uses an enterprise-grade security protocol known as WPA-EAP. This protocol includes a digital certificate to prove the identity of th

<h1 id="isPasted">Introduction</h1>The main 5S&#xAE; tenant Wi-Fi network at EngineWorks Bozeman is:EngineWorks 5S Main&#xA0; The main 5S&#xAE; tenant Wi-Fi network uses an enterprise-grade security protocol known as WPA-EAP. This protocol includes a digital certificate to prove the identity of the OpticWise 5S Authentication service. See &quot;Enterprise Wi-Fi Authentication and Certificates&quot; for more detail on those subjects.This security protocol allows you to be assured that you are connecting your Wi-Fi clients to correct Wi-Fi network (as verified by the verifiable &quot;fingerprint&quot; of the underlying authenticating server), and prevents connections to an impostor network by the same name, which could attempt to steal user credentials or spy on your communications.Note:&#xA0;Users should never just click accept (or connect) on new certificate warnings, because these might be generated by an impostor network. Always follow the validation steps below.Users (or their company IT administrators) must validate <a href="https://drive.google.com/file/d/1VU5ctVjNI2tuB0FqtPtg5NqlEfWqAx0T/view?usp=drive_link">this OpticWise 5S Authentication service certificate</a> and mark it as trusted for EAP use on devices on the first connection to the network (and whenever the certificate is replaced every few years). OpticWise will send proactive notification emails when certificates are soon to be replaced.We recommend users pre-accept the new certificates before they are activated, so that they won&apos;t be surprised by a certificate validation request when they arrive onsite and don&apos;t yet have Internet access.Companies using Mobile Device Management systems to centrally manage Wi-Fi client devices are encouraged to push new certificates out to clients as soon as they are announced.<h1 id="validating-certificates">Validating Certificates</h1>When a Wi-Fi connecting device detects a new certificate that is not yet trusted, it presents some details of the certificate for the user to inspect and either validate or reject. OpticWise recommends users validate the certificate details (different devices show different details, see the specific examples below).If your client shows these details, verify that the certificate expires on Feb 1, 2030, and was signed by the <a href="https://drive.google.com/file/d/1hKuzvp-ZmenrIlYdZNOLbX25htpMm956/view?usp=sharing">OpticWise 5S R1 Root CA</a> through the OpticWise 5S R1 Intermediate CA.Next, verify any fingerprints that your device shows for the OpticWise 5S Authentication certificate. This detail is the most critical. The following sections explain where to find the fingerprints for common device types.Your device should show at least one or two of the following types of fingerprints. Some devices refer to these as thumbprints: <table style="width: 100%;"><tbody><tr><td style="width: 50.0000%;">SHA-1</td><td style="width: 50.0000%;">AB:E6:30:76:BB:64:20:52:AC:AA:0A:C1:D5:81:7B:78:9F:CD:3A:7D</td></tr><tr><td style="width: 50.0000%;">SHA-256</td><td style="width: 50.0000%;">3B:9A:FE:3F:BE:76:26:45:78:48:E6:85:31:7D:61:50: 94:7D:23:84:28:4F:3A:BF:7B:61:D1:93:1C:76:2A:67</td></tr><tr><td style="width: 50.0000%;">SHA-512</td><td style="width: 50.0000%;">17:B4:41:46:5B:DA:BA:A2:E3:D5:29:06:39:F2:DC:00: EE:F6:BC:A7:75:9A:C8:1E:27:3D:86:E6:AA:10:D6:7B: A6:2F:13:C6:0E:E5:4F:E3:0C:AA:3A:F0:0C:1F:21:B6: C5:18:C4:72:1B:06:4C:B5:10:2E:23:2D:ED:EC:29:6F</td></tr></tbody></table> If your device shows a fingerprint that does not match any of those shown in this table, do not accept the certificate or mark it as trusted. In this case we recommend you take a screenshot and provide it to your staff IT admin, site admin, or OpticWise support.Once you&apos;ve verified the fingerprints, you can accept the authentication server certificate as being trusted on your device.You may notice that your device does not trust the root or intermediate certificates. On current versions of Windows and macOS, there is no security advantage to trusting the root or intermediate certificates, so we recommend that users or IT administrators not do so for those platforms. You only need to verify and trust the OpticWise 5S Authentication server certificate.However, on Google and Android systems, it is necessary to trust the root certificate (see below).<h1 id>&#xA0;</h1><h1 id="device-and-operating-system-examples">Device and Operating System Examples</h1>The following examples show what to expect when validating the certificate on common devices and operating systems.&#xA0;<h2 id="isPasted">Microsoft Windows 10/11</h2>Windows client currently show only the certificate name, intermediate certification authority name, and the SHA-1 fingerprint of the certificate, but not the expiration date. Even this abbreviated amount of information is enough to validate and trust the certificate.Select your main tenant Wi-Fi network:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-34e35d5f-ed8a-4759-8b6a-e6464e287a27-28fcb295-cf80-4e88-8c13-d3fc463df43d.png" class="fr-fic fr-dii">Enter your username (email address), and your personal strong password:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-b3b68bee-e7e1-414f-8b11-34b814470680-2cdf85d9-99e1-4461-827b-27d9e29fb344.png" class="fr-fic fr-dii">Examine the certificate&apos;s fingerprint. Especially notice the last few characters, which should be CD 3A 7D:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-bfe8b4b5-5864-4e39-be99-e05a7ee6206f-325f3acc-f2d1-4ced-bf4a-1521c4a007e1.png" class="fr-fic fr-dii">Click &quot;Connect&quot;. You are now connected to your main tenant 5S&#xAE; Wi-Fi network, and the status should show &quot;Connected, secured&quot;:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-355d6247-e6b1-4242-919c-5d12321ee817-6c144f17-1e2e-4fa6-9df4-6cc2ba7a317c.png" class="fr-fic fr-dii"><h2 id="-1">&#xA0;</h2><h2 id="isPasted">Apple macOS</h2>Select your main 5S&#xAE; tenant Wi-Fi network, then enter your username (email address), and your personal strong password:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-f9a29ce8-4e30-4da6-8191-b26365f0ab4f-aa719135-d9f1-4b1d-91ef-2cf6fab4b352.png" class="fr-fic fr-dii">&#xA0;Apple macOS shows the following dialog to allow you to verify that you are connecting to the legitimate main 5S&#xAE; tenant Wi-Fi network, with authentication provided by the OpticWise 5S Authentication server:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-c34aff60-5c73-48e9-957e-a79c547e0c58-1153fa4d-ceaf-49ad-b363-6dd49bfb79ec.png" class="fr-fic fr-dii">Click &quot;Show Certificate&quot; to examine the certificate:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-08468cbf-e789-4b13-991c-8633f4f4fa23-d12ee00d-c8f2-4422-9738-964b58437532.png" class="fr-fic fr-dii">Expand the &quot;Details&quot; section, then scroll down to the bottom &quot;Fingerprints&quot; section:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-695e648c-cc52-4d2c-85bf-779413296a9a-7ccff06f-8224-42b2-9c42-754d508aabcb.png" class="fr-fic fr-dii">Confirm that the SHA-256 and/or SHA-1 fingerprint matches what is shown above (i.e. focus on the last 6 or so characters), and if so, click &quot;Continue&quot; to accept/install/trust the certificate on your Mac computer.Depending on the security settings on your Mac, you may be prompted with a dialog box like this requesting your approval to install the certificate:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-36097841-ba6f-41e4-8d65-60748c2111d5-a6185dca-c198-41e4-b574-04d9e387c49f.png" class="fr-fic fr-dii">&#xA0;Click &quot;Use Password&quot; and enter the password you use to login to your Mac. Note that this is NOT asking you for your Wi-Fi password.&#xA0;<h2 id="apple-ios">Apple iOS</h2>Select your main 5S&#xAE; tenant Wi-Fi network, then enter your username (email address), and your personal strong password:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-ce05032c-aa72-432e-a1bf-fe96b4f3ec21-a3ec645a-91bf-4488-9486-dfcd9f5f4b0f.png" class="fr-fic fr-dii">&#xA0;Apple iOS shows the following dialog to allow you to verify that you are connecting to the legitimate main 5S&#xAE; tenant Wi-Fi network, with authentication provided by the OpticWise 5S Authentication server:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-316a581e-cb7c-42d6-b1c0-d397f3f06aed-e679f0b9-51d0-476b-8ea9-a300e11edf5c.png" class="fr-fic fr-dii">&#xA0;Click &quot;More Details&quot;, then scroll to the bottom of the page to find the Fingerprints section. Verify the fingerprints exactly match the values shown below. The fingerprints are the most critical detail to verify.<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-fb45fe3f-4c97-426d-868e-e335ec4fb2c9-0adb38d0-b317-43b2-b482-78c5249f69ac.png" class="fr-fic fr-dii">If the fingerprints you observe match the fingerprints shown above, click the &lt; Certificate at the top of the screen to get back to the main Trust page, then click Trust.&#xA0;<h2 id="google-chromeos">Google ChromeOS</h2>Download and install/trust the certificate<ol><li>From the Chrome browser, download the <a href="https://drive.google.com/file/d/1hKuzvp-ZmenrIlYdZNOLbX25htpMm956/view?usp=sharing">OpticWise 5S R1 Root CA certificate</a> to your local storage.</li><li>At the top right corner of your Chrome browser, click the three vertical dots to access the Customize and control Google Chrome menu</li><li>Click Privacy &amp; security, then Security, then Manage Certificates</li><li>Click the Authorities tab</li><li>Click on Import, then select the opticwise-5s-r1-root.crt that you just downloaded</li><li>Click Open</li><li>For Trust Settings, check the boxes for Trust this certificate for identifying websites</li><li>Click OK</li></ol>Join the Wi-Fi network.<ol><li>Select Settings &gt; Network, then select the main 5S&#xAE; tenant Wi-Fi network</li><li>For EAP Method, select EAP-TTLS (not EAP-TLS)</li><li>For EAP Phase 2 Authentication, select PAP</li><li>For Server CA certficate, seleect OpticWise 5S R1 Root CA</li><li>For Identity, enter the email address for your account</li><li>For Password, enter your personal strong password that you previously set on your account</li><li>Slide the Save identity and password&#xA0;bar to the right to enable the setting</li><li>Select Connect</li></ol>&#xA0;<h2 id="android-phones-and-tablets">Android Phones and Tablets</h2>Joining Android devices is more complicated than with other operating systems, and due to the customized choices that different manufacturers and service providers make, it&apos;s simply not possible to delineate all of the paths involved in setting up WPA2-Enterprise username-based Wi-Fi authentication.&#xA0;For example, you might be able to preemptively download the <a href="https://drive.google.com/file/d/1hKuzvp-ZmenrIlYdZNOLbX25htpMm956/view?usp=sharing">OpticWise 5S R1 Root CA certificate</a>, review it, and trust it for your connection. Or you might have to choose &quot;Trust on first use&quot; for the certificate setting, or some manufacturers might only allow you to choose CA Certificate = None.For these reasons, we recommend that you instead onboard your Android device as a trusted IoT Device (in the 5S&#xAE; portal), then join it to the IoT Wi-fi network. For more information, please refer to the &quot;Android MAC Address Randomization - Private Address&quot; help center article.

Validating Enterprise Wi-Fi Certificates

HP often mis-documents or under-documents the process to get WiFi printing set up, and it varies depending on the HP printer model number. Be aware that joining HP’s printers to WiFi can be frustrating, and the experience with button presses and cabl

<main id="isPasted"><section><section>HP often mis-documents or under-documents the process to get WiFi printing set up, and it varies depending on the HP printer model number. Be aware that joining HP&#x2019;s printers to WiFi can be frustrating, and the experience with button presses and cable maneuvers greatly vary depending on the model of the HP printer.For example, instead of allowing the printer to join a WiFi network as a client, HP likes to program non-standard methods and document them as if they&#x2019;re seamless, when they absolutely are not. Many users we have worked with who have just purchased the HP printer have ended up returning it in favor of a different brand, like Brother or Canon.Here are steps that should work to get your wireless-capable HP printer joined to the WiFi network.Note: This has been tested with HP OfficeJet/Deskjet (models 4100, 5252, 9018E)&#xA0;printersAt the printer&apos;s main menu, go to WiFi Direct Details:<ul><li>verify WiFi Direct is on/enabled.</li><li>take note of the password [&quot;security key&quot;], as you&apos;ll need it in the next step</li></ul>On a computer, join the printer&apos;s WiFi network called &quot;DIRECT-&lt;unique_name&gt;&quot;.For example, the printer in our test was broadcasting the network named DIRECT-4B-HP OfficeJet 5200&#xA0;On your computer, browse in your internet browser to the printer&apos;s IP address. In all of our tests (internal and with end users), the printer&apos;s IP address is 192.168.223.1You should be met with your printer&apos;s web management interface.Confirm that you see something similar to the following:<img src="https://attachments.gorgias.help/RdOkb7oZdjo2VXGN/hc/Aa90l7EwdA6JWorj/2024072605-b996d86f-5c4c-4ab2-96a5-8b14649fe5df-407bf67c-a8d9-4725-a6f7-131d77f0b867.png" class="fr-fic fr-dii">In the Wireless Setup Wizard, select the Wireless tab, then Advanced.Note: For some HP models, you will additionally see the message &quot;locked by Administrator&quot;, and you will be prompted to enter a PIN or password. In this case, you will find a label on the printer (likely inside the ink cartridge area) that has the PIN or password printed on it.Select the following options:<ul><li>network interface: on</li><li>SSID: select your campus&apos; IoT WiFi network (likely containing &quot;IoT&quot; or &quot;Aux&quot;)</li><li>Authentication: WPA-PSK, then select WPA2</li><li>Encryption: AES</li><li>Passphrase: enter, then confirm, the passphrase of your campus&apos; IoT network</li></ul>Click ApplyNote: Depending on the printer model, the printer might require you to also enter the same SSID and password information you just entered, but this time physically on the printer itself.Your printer should now join your campus&apos; IoT network as a WiFi client, and any device that you join to WiFi in your private network domain will be able to print to your printer.<h2 id="reference-articles">Reference Articles</h2>These are various articles we have gathered from HP forums and instructional videos that may help you navigate issues with HP WiFi printers.&#xA0;Converting an HP Printer from a USB to a Wireless Connection in Windows | HP Printers | HP<a href="https://www.youtube.com/watch?v=F3Wilc2hrP0" rel="noopener" target="_blank">https://www.youtube.com/watch?v=F3Wilc2hrP0</a>Connecting printer to both USB and WIFi - HP Support Community - 6510219<a href="https://www.google.com/url?q=https%3A%2F%2Fh30434.www3.hp.com%2Ft5%2FPrinting-Errors-or-Lights-Stuck-Print-Jobs%2FConnecting-printer-to-both-USB-and-WIFi%2Ftd-p%2F6510219&amp;sa=D&amp;sntz=1&amp;usg=AFQjCNHr9Bby_BlLUs8rO1r_bqNUTE99dg" rel="noopener" target="_blank">https://h30434.www3.hp.com/t5/Printing-Errors-or-Lights-Stuck-Print-Jobs/Connecting-printer-to-both-USB-and-WIFi/td-p/6510219</a>HP printers - Wireless connection is lost after router or network settings change<a href="https://www.google.com/url?q=https%3A%2F%2Fsupport.hp.com%2Fmy-en%2Fdocument%2Fish_2819263-1626554-16&amp;sa=D&amp;sntz=1&amp;usg=AFQjCNE4WniZY6FLzXvaWrE3L15NgWlkCQ" rel="noopener" target="_blank">https://support.hp.com/my-en/document/ish_2819263-1626554-16</a>HP Printer won&apos;t connect to router updated from WPA to WPA2 - HP Support Community - 7917483<a href="https://www.google.com/url?q=https%3A%2F%2Fh30434.www3.hp.com%2Ft5%2FPrinter-Wireless-Networking-Internet%2FHP-Printer-won-t-connect-to-router-updated-from-WPA-to-WPA2%2Ftd-p%2F7917483&amp;sa=D&amp;sntz=1&amp;usg=AFQjCNET6NIVhDsKtZC6ldLpEofStF9K4Q" rel="noopener" target="_blank">https://h30434.www3.hp.com/t5/Printer-Wireless-Networking-Internet/HP-Printer-won-t-connect-to-router-updated-from-WPA-to-WPA2/td-p/7917483</a>How to Connect Your Printer to WiFi<a href="https://www.google.com/url?q=https%3A%2F%2Fstore.hp.com%2Fus%2Fen%2Ftech-takes%2Fhow-to-connect-printer-to-wifi&amp;sa=D&amp;sntz=1&amp;usg=AFQjCNEx6itn6PQUCUcDzMFp9OX0R9xYbQ" rel="noopener" target="_blank">https://store.hp.com/us/en/tech-takes/how-to-connect-printer-to-wifi</a>Connecting your HP wireless printer | Wireless Printing Center<a href="https://www.google.com/url?q=https%3A%2F%2Fwww8.hp.com%2Fpk%2Fen%2Fcampaigns%2Fwireless-printing-center%2Fprinter-setup-help.html&amp;sa=D&amp;sntz=1&amp;usg=AFQjCNEA7Vv22WPU2Mhs95B5sWA9-odnqw" rel="noopener" target="_blank">https://www8.hp.com/pk/en/campaigns/wireless-printing-center/printer-setup-help.html</a></section></section></main>

HP Printers - WiFi Printing

If you have a device that does not have native high-performance Wi-Fi capability, this article lists some inexpensive options to convert the device so that it can be connected to Wi-Fi and into your private tenant domain. Use cases where this Option

<main id="isPasted"><h1 id="5s-tenant-wi-fi-networks">5S&#xAE; tenant Wi-Fi networks</h1><ul><li id="isPasted" style="font-size: 16px;">Primary tenant network: EngineWorks&#xA0;5S Main</li><li style="font-size: 16px;">IoT tenant network: EngineWorks&#xA0;5S IoT</li></ul> <h1 id="wired-only-device-options">Wired-Only Device Options</h1>If you have a device that does not have native high-performance Wi-Fi capability, this article lists some inexpensive options to convert the device so that it can be connected to Wi-Fi and into your private tenant domain. <h2 id="option-1-usb-wireless-adapter">Option 1: USB Wireless Adapter</h2>Use cases where this Option is a good fit:<ul><li>your device is running a desktop operating system, like Windows, MacOS, or Linux</li><li>you have a computer with no viable Wi-Fi option (e.g. weak Wi-Fi antenna or no Wi-Fi antenna)</li><li>your device has an available USB interface</li></ul>TP-link Archer T4U Plus USB Dongle Adapter with 5dBi Antenna<ul><li><h3 id="httpswwwamazoncomdpb08khv7h1s"><a href="https://www.amazon.com/dp/B08KHV7H1S">https://www.amazon.com/dp/B08KHV7H1S</a></h3></li></ul>How it works:<ul><li>&#xA0;Physical Connection: plugs into your device&apos;s USB port</li><li>high-performance high-gain antenna</li><li>802.11ac 2-stream MU-MIMO capable, dual-band support (5GHz and 2.4GHz)</li><li>also a good high-performance option if your device&apos;s integrated Wi-Fi chipset is underpowered/underperforming</li><li>supports 802.1x WPA2-Enterprise security, so you do not need to onboard as an IoT device in the user portal. Rather, join the main Wi-Fi network with your username and password.</li></ul>Note: Once installed, be sure to configure the adapter to use its more capable 5GHz antenna by setting these options on the adapter:<ul dir="auto"><li>VHT 2.4G set to off</li><li>Wireless Mode set to IEEE 802.11ac</li></ul><h2 id> </h2><h2 id="option-2-wired-ethernet-client-adapters">Option 2: Wired Ethernet Client Adapters</h2>Use cases where this Option is a good fit:<ul><li style="font-size: 16px;">your device is running a non-standard (and possibly proprietary) operating system</li><li style="font-size: 16px;">you have a computer with no Wi-Fi option (e.g. work-from-home scenario where employer requires physical Ethernet connection)</li><li style="font-size: 16px;">you have a gaming system that has a spotty integrated Wi-Fi chipset (i.e. Sony PS5)</li></ul><h3 id="option-2a---good-glinet-gl-a1300---for-ethernet-ports">Option 2a - Good: GL.iNet GL-A1300 - for Ethernet Ports</h3><ul><li style="font-size: 16px;"><h3 id="httpswwwamazoncomdpb0b4zsr2px"><a href="https://www.amazon.com/dp/B0B4ZSR2PX">https://www.amazon.com/dp/B0B4ZSR2PX</a></h3></li></ul>How it works:<ul><li style="font-size: 16px;">Physical Connection: plugs into your device&apos;s Ethernet port</li><li style="font-size: 16px;">your device sees the connection as a &quot;standard&quot; wired Ethernet connection</li><li style="font-size: 16px;">can be powered via your device&apos;s USB port or via standard wall outlet</li><li style="font-size: 16px;">802.11ac capable, single-stream</li><li style="font-size: 16px;">dual-band support (5GHz and 2.4GHz)</li><li style="font-size: 16px;">can be joined directly to the main tenant network with your username and personal password (since it supports WPA2-Enterprise security)</li></ul><h3 id="option-2b---fastest-but-expensive-and-hard-to-find-aruba-networks-501-client-adapter---for-ethernet-ports">Option 2b - Fastest (but expensive, and hard to find): Aruba Networks 501 Client Adapter - for Ethernet Ports</h3>Part Numbers:<ul><li style="font-size: 16px;">Main unit: J9835A</li><li style="font-size: 16px;">Power Supply: J9405C#ABA</li></ul>How it works:<ul><li style="font-size: 16px;">Physical Connection: plugs into your device&apos;s Ethernet port</li><li style="font-size: 16px;">your device sees the connection as a &quot;standard&quot; wired Ethernet connection</li><li style="font-size: 16px;">802.11ac capable, 3x3 MIMO with three spatial streams</li><li style="font-size: 16px;">dual-band support (5GHz and 2.4GHz)</li><li style="font-size: 16px;"><main id="isPasted">can be joined directly to the main tenant network with your username and personal password (since it supports WPA2-Enterprise security)</main></li></ul></main>

Connecting Wired-Only Devices to Wi-Fi

5S® network portal: engineworks.5s.solutions. Primary 5S® tenant Wi-Fi network: EngineWorks 5S Main. Note: This article applies to native 5S® user accounts, not to tenant accounts where the tenant organization's directory integration is in place. In

<main id="isPasted">5S&#xAE; network portal: <a href="http://engineworks.5s.solutions">engineworks.5s.solutions</a>Primary 5S&#xAE; tenant Wi-Fi network: EngineWorks 5S Main Note: This article applies to native 5S&#xAE; user accounts, not to tenant accounts where the tenant organization&apos;s directory integration is in place.In order to reset the password on your user account, follow these quick steps:<ul><li style="font-size: 16px;">Navigate to the 5S&#xAE; network portal</li><li style="font-size: 16px;">Click the Forgot Password button</li><li style="font-size: 16px;">Enter your email address</li><li style="font-size: 16px;">Click the Send Verification button</li><li style="font-size: 16px;">Check your inbox for an email from <a href="mailto:onboarding@opticwise.com">onboarding@opticwise.com</a>. Click the one-time use link in that email.</li><li style="font-size: 16px;">Follow the on-screen directions to set your new password</li></ul>Please remember that, after you change your password, you&#x2019;ll need to forget and rejoin any devices that you had previously joined to the primary&#xA0;tenant&#xA0;Wi-Fi network, since those devices would still be trying to authenticate with your old password.</main>

Resetting your 5S® network password

Introduced in the Android 10 operating system is a Private Address feature that randomizes the MAC address used by your Android device when you connect to a Wi-Fi network. This feature is enabled by default, but can be disabled for specific Wi-Fi net

<h1 id="isPasted">5S&#xAE; tenant Wi-Fi networks</h1><ul><li style="font-size: 16px;">Primary tenant network: Engineworks&#xA0;5S Main</li><li style="font-size: 16px;">IoT tenant network: Engineworks&#xA0;5S IoT </li></ul> <h1 id="summary">Summary</h1>Introduced in the Android 10 operating system is a Private Address feature that randomizes the MAC address used by your Android device when you connect to a Wi-Fi network. This feature is enabled by default, but can be disabled for specific Wi-Fi networks.&#xA0;When connecting to your private tenant network domain through the Wi-Fi networks on the 5S&#xAE; campus, if you&apos;re authenticating to the primary tenant network, since your authentication is based off of your user account and password, it&apos;s okay to keep MAC randomization enabled.But users should disable MAC randomization if you need to onboard your Android as an IoT device to the IoT network, for example, when certain IoT devices simply will not join the Wi-Fi network unless the app on the Android device you&apos;re attempting to control it from is also joined to that exact same named network.Complete these steps for the IoT network.Samsung Galaxy<ol><li style="font-size: 16px;">Navigate to &quot;Settings&quot;</li><li style="font-size: 16px;">Select &quot;Connections&quot;</li><li style="font-size: 16px;">Select &quot;Wi-Fi&quot;</li><li style="font-size: 16px;">Select the IoT network to connect</li><li style="font-size: 16px;">Tap the gear shaped icon next to the network you connected to</li><li style="font-size: 16px;">Select &quot;Advanced&quot;</li><li style="font-size: 16px;">On the next screen there is a menu labeled &quot;MAC Address Type&quot;. Tap on &quot;MAC Address Type&quot;</li><li style="font-size: 16px;">Select &#x201C;Use Phone/Device MAC&#x201D;</li></ol>Note: The &quot;Wi-Fi Address&quot; listed is your device&apos;s true MAC Address. This is the address you will use to IoT-onboard in the 5S&#xAE; network portal.After you have completed onboarding your iPhone/iPad in the 5S&#xAE; network portal, join it to the IoT network (ensuring that the Private Address feature is disabled).&#xA0;Google Pixel<ol><li style="font-size: 16px;">Open the Settings app</li><li style="font-size: 16px;">Select Network and Internet</li><li style="font-size: 16px;">Select Wi-Fi</li><li style="font-size: 16px;">Connect to the IoT network</li><li style="font-size: 16px;">Tap the gear icon next to the current connection</li><li style="font-size: 16px;">Select Advanced</li><li style="font-size: 16px;">Select Privacy</li><li style="font-size: 16px;">Select &quot;Use device MAC&quot;</li></ol>Note: The &quot;Wi-Fi Address&quot; listed is your device&apos;s true MAC Address. This is the address you will use to IoT-onboard in the 5S&#xAE; network portal.After you have completed onboarding your iPhone/iPad in the 5S&#xAE; network portal, join it to the IoT network (ensuring that the Private Address feature is disabled).

Android MAC Address Randomization - Private Address

IoT tenant network: EngineWorks 5S IoT. On an enterprise-secured WiFi network, Android devices require you to make manual/distinct choices for security options. Join your Android device to the IoT tenant network so that it will be joined to your priv

<main id="isPasted">IoT tenant network: EngineWorks&#xA0;5S IoTOn an enterprise-secured WiFi network, Android devices require you to make manual/distinct choices for security options.&#xA0;Join your Android device to the IoT tenant network so that it will be joined to your private tenant network domain.Please refer to the Android section of the &quot;Android MAC Address Randomization - Private Address&quot; help center article.</main>

FAQ