Wi-Fi Improvement Project

How to Prepare for CU Secure Wi-Fi

There's no downside to registering your personal devices in advance. Do it now:

Where to Experience the New Wi-Fi

The new Wi-Fi networks, CU Secure and CU Guest, are now live in select early-access buildings:

After final exams in late December 2025, all other campus buildings will change over to the new Wi-Fi.

OverviewBenefits of CU SecurePrepare Your DevicesFAQSupport & Feedback

Overview

This project's goal is to improve the day-to-day Wi-Fi experience for campus users. So far, the project team has upgraded key network components and has replaced UCB Wireless and UCB Guest in early-access buildings with new Wi-Fi networks that better meet the campus's needs.

The eduroam Wi-Fi network is not affected.

Benefits of CU Secure
(replaces UCB Wireless)

Two-year registration period
Certificate-based authentication instead of IdentiKey login
Enterprise-grade, end-to-end encryption
Improved support tools
Better integration with CU Boulder's Secure Computing standard for computers

Benefits of CU Guest
(replaces UCB Guest)

Start-of-semester IdentiKey login for users who haven't yet installed the CU Secure certificate
Improved support tools
Device portal for self-enrollment of gaming consoles, smart TVs and other specialty Wi-Fi devices
Event portal for pre-assigning guest Wi-Fi credentials to event attendees

Why Use CU Secure Wi-Fi?

In most campus locations, CU Secure provides the best Wi-Fi experience for CU Boulder students, faculty and staff. Learn why below.

Compare: CU Secure vs. CU Guest

If you have an IdentiKey, then CU Secure will provide a much smoother campus Wi-Fi experience for you compared to CU Guest.

In general, CU Secure requires fewer logins, allows you to connect more devices to the network, and facilitates a quicker network connection when you enter a campus building.

Network Settings	CU Secure	CU Guest
Registration frequency: How often you need to register the device	Every 2 years	Every day
Registration period: How often you need to request new guest credentials	N/A	Every 7 days¹
Number of devices: How many of your devices can access Wi-Fi	No limit	Up to 3 devices
Speed to join: How quickly your devices recognize and join the network²	Nearly instantaneous	Up to 30 seconds

In addition, CU Secure provides additional security, stability and access benefits compared to CU Guest.

Network Features	CU Secure	CU Guest
Encrypts Wi-Fi traffic	Yes	No
Seamlessly handles Private Wi-Fi Address rotation³	Yes	No
Allows access to internal CU websites and resources	Yes	Limited
Supports printing to wired campus printers	Yes	No

¹For most of the year, CU Guest only allows logins using guest Wi-Fi credentials. Once requested, guest credentials remain active for a period of seven days, after which the user must request new guest credentials. The seven-day registration period does not apply to faculty, staff and students who log in using their IdentiKey credentials, which is only permitted during the first few weeks of the fall and spring semesters.

²In general, Wi-Fi devices connect more quickly to CU Secure than CU Guest because devices recognize CU Secure as the most encrypted and so "preferred" network. CU Guest's lack of encryption makes it less preferred, resulting in a slower initial connection as the device searches for a more secure network to join instead.

For most Secure Computing devices, when waking from a sleep state (e.g., having their lid opened), there is no delay in connecting to CU Secure. There is a slight delay in connecting to CU Guest, because the device needs to negotiate the connection.

³Visit Wireless Internet - Help to learn how Apple's Private Wi-Fi Address feature can cause connectivity issues when using a Wi-Fi network that doesn't have certificate-based authentication (e.g., CU Guest).

Compare: CU Secure vs. eduroam

If you're regularly traveling between CU Boulder and other eduroam institutions, then it makes sense to use eduroam at those locations.

However, when you're on the CU Boulder campus, we recommend using CU Secure for two key reasons:

CU Secure was designed with CU Boulder's user base and IT infrastructure in mind. As a locally hosted network, our support staff thoroughly understand the network configuration and have access to a wider range of troubleshooting tools.
CU Secure uses a stronger authentication method than eduroam (EAP-TLS vs. PEAP and EAP-TTLS), protecting you from certain vulnerabilities.¹

Here's a quick comparison of each network's features:

Network Features	CU Secure	eduroam
Encrypts Wi-Fi traffic	Yes	Yes
Authenticates without sending passwords over Wi-Fi¹	Yes	No
Maintains Wi-Fi connection if passwords change²	Yes	No
Allows access to internal CU websites and resources	Yes	Yes
Supports printing to wired campus printers	Yes	Yes
Is available at other participating institutions³	No	Yes

¹To connect to an encrypted Wi-Fi network, your device is required to send certain identifying information over Wi-Fi to the network's authentication server. eduroam's authentication methods (PEAP and EAP-TTLS) rely on a server-side certificate only, so your device needs to send your username and password to confirm your identity. In contrast, CU Secure uses both client and server certificates (EAP-TLS), allowing the server to verify your identity using the certificate on your device rather than your IdentiKey credentials.

²Your device uses your saved IdentiKey credentials to connect to eduroam. If your username or password changes, your device will continue to send your previous credentials until you manually update them. This doesn't occur on CU Secure, because it doesn't use your IdentiKey credentials to verify your identity.

³eduroam is available at more than 3,800 locations in the U.S. and more than 38,000 locations worldwide.

Compare: CU Secure vs. Your Data Plan

Your mobile carrier's cellular network is your best option in locations where campus Wi-Fi signals are weak or non-existent, like outdoors or in a stairwell.

However, if you're inside a campus building, CU Secure will almost always provide a better wireless experience compared to your data plan.

Network Features	CU Secure	Carrier Data Plan
Cost	Included in tuition	Depends on your plan
Data limit	None	Depends on your plan
Performance	Generally faster, smoother experience	Depends on signal strength¹
Indoor coverage, including classrooms	Designed for full indoor coverage	Depends on signal strength¹
On-campus support available	Yes	Limited
Allows access to internal CU websites and resources	Yes	Limited

¹The quality of a user's wireless internet experience is heavily dependent on both environmental factors and overall demand for network resources.

Signal strength is typically affected by the user's distance from a Wi-Fi access point or cell tower, type and quantity of physical obstructions between the user and the signal source, and interference from neighboring Wi-Fi devices.
Connection speeds are typically affected by the number of networks being broadcast at a time and the number of devices connected to or active on the network in a given location.

Prepare Your Devices

University-Purchased Computers (No Action Needed)

If your computer was purchased through the university, check to see if it's enrolled in the Secure Computing program:

Check If You Have a Secure Computing Laptop

If so, then it already has the CU Secure certificate installed. No action is needed for that device.
If not, install the CU Secure certificate using the personal device instructions below.

Personal Laptops, Smartphones & Tablets (Action Needed)

If you typically connect a personal laptop, smartphone or tablet to UCB Wireless or UCB Guest, you'll need to install the CU Secure certificate to register it on the network.

Install the Certificate on a Personal Laptop or Mobile Device

The installation process varies by operating system and user settings. For the smoothest experience, follow along with these step-by-step instructions or videos.

Once installed, the certificate/app will allow your device to connect to CU Secure automatically for two years before prompting you to re-register.

Specialty Wi-Fi Devices

Business-Critical Devices

OIT is currently migrating the records of existing business-critical Wi-Fi scanners, temperature sensors and other Wi-Fi devices from UCB Wireless to the new networks. Once CU Secure and CU Guest are live in your building, those devices should connect to the new networks automatically or after a reboot or reset.

Personal Devices (Gaming Consoles, Smart Devices)

If you brought a personal consumer Wi-Fi device to campus (e.g., gaming console, smart TV, smart speaker), you can self-register it on CU Guest through the Specialty Wi-Fi Devices Portal.

Note: For security purposes, the portal can only be accessed from a non-guest campus network (i.e., UCB Wireless, CU Secure, eduroam, wired internet) or the campus VPN.

Frequently Asked Questions

These FAQs are specific to this project's scope and timeline. For network-specific FAQs, see CU Secure Wi-Fi - FAQ and CU Guest Wi-Fi - FAQ.

Will UCB Wireless and UCB Guest still be available in early-access buildings?

No. To prevent impacts to Wi-Fi signal strength, campus buildings will only ever have three Wi-Fi networks broadcasting at a given time:

eduroam
UCB Wireless or CU Secure
UCB Guest or CU Guest

Wherever CU Secure and CU Guest are available, UCB Wireless and UCB Guest are not. When the project completes in late December, UCB Wireless and UCB Guest will be permanently retired.

Which Wi-Fi network should I use?

If you're capable of installing the CU Secure certificate (i.e., if you have an active IdentiKey and your device allows a certificate to be installed), we always recommend using CU Secure Wi-Fi when it's available.

Here's a brief overview of the users who are best served by each campus Wi-Fi network:

Wi-Fi Network	Who should use it	Login Requirement
CU Secure	All CU Boulder affiliates with an active IdentiKey	Once every two years
eduroam	Faculty, staff, students and visitors from institutions that use eduroam	Once every 12 months
CU Guest	Guests visiting the CU Boulder campus	Daily

For a detailed comparison of the benefits of CU Secure versus CU Guest, eduroam and your data plan, see the Overview section above.

When I move between regular campus buildings and early-access buildings, will I have to re-register on campus Wi-Fi?

No. Once you've downloaded and installed the CU Secure certificate on your device, your Wi-Fi connection should automatically shift between CU Secure and UCB Wireless as you move out of one service area and into another.

Will this project solve every Wi-Fi problem on campus?

No. This project is scoped to address the Wi-Fi problems discussed above, including improving network registration stability and allowing users to self-enroll their gaming consoles, smart TVs and other screenless Wi-Fi devices.

Issues that are out of scope for this project include those related to poor connectivity in certain areas of campus, outdoor Wi-Fi coverage, and the cellular network provided by mobile carriers (e.g., Verizon, T-Mobile, AT&T).

Support & Feedback

If you have project-related questions, send an email to oithelp@colorado.edu with Wi-Fi Improvement Project in the subject line.

To improve the Wi-Fi registration process for the rest of campus, please share your experience:

Provide Registration & Connection Feedback