Thank you so much Quinn, The documentation about uniqueness in the keychain, and the reset keychain function were extremely helpful in debugging my issues. I will lay them out here for other users who may end up in my prediciment. The import of the pk12 file was not putting keys in the keychain, the identity was leftover from previous testing, and was causing me more issues than I would like to admit. The posts you linked should be official documentation because they are more helpful than anything else I could find on my own. Once I was sure that I was adding the identity correctly, I found I was getting rejected for missing entitlements. I triple checked that everything was correct ( my plist info file was correctly adding my AppIdentifierPrefix ) I found something very frustrating in the official apple developer documenation: https://developer.apple.com/documentation/networkextension/nehotspoteapsettings/setidentity(_:)#Discussion $(Team​Identifier​Prefix)com​.apple​.networkextensionsharing. The entitlement group in the documentation has a unicode zero width space between apple and .networkextensionsharing. so when I copied it into my entitlements, it would not work. Once I fixed these two things I was able to add everything needed to the keychain and get a working EAP-TLS setup. Thanks again.