Wi-Fi 7 Wired Backhaul: Open Networking’s Next Test

OpenWiFi 4.0 delivered a fully disaggregated Wi-Fi 7 radio. The switch feeding it still runs on the ownership model open networking was built to replace.

The Telecom Infra Project’s OpenLAN community shipped OpenWiFi 4.0 in June 2025, and it does what open networking has promised for years: a Wi-Fi 7 radio stack that runs on hardware from Edgecore, CIG, or Cybertan, managed from whichever controller an operator picks rather than the one a single vendor ships with the box. That result is real, and it is well earned. It also exposes a wired backhaul gap that nobody planned around when the project started.

The gap sits one layer down from the radio. Wi-Fi 7 access points draw enough power and generate enough traffic that the switch feeding them stops being a passive afterthought, right at the same moment the identity system authenticating every device on the network needed a full rebuild before its legacy certificate infrastructure reached end-of-life. Both problems became urgent on the same timeline, and neither gets solved by a faster radio.

Wireless disaggregation is a finished argument at this point. What OpenWiFi 4.0 and the parallel PKI 2.0 program actually demonstrate is that the same discipline (open identity, open hardware, and vendor-neutral software) has to extend past the access point to the switch it plugs into, or the gains made on the radio side get quietly undone at the switch port.

In this article, you will discover why Wi-Fi 7 hardware turns the wired uplink into a bottleneck, how PKI 2.0 rebuilds network trust without handing it to a single vendor, and how PLVision built SONiC Lite to carry that same disaggregation logic onto the access switch sitting underneath OpenWiFi’s radios.

Wi-Fi 7 Arrived Faster Than the Identity Layer Could Keep Up

OpenWiFi 4.0’s headline result is a tested peak throughput of more than 3 Gbps across every validated Wi-Fi 7 hardware platform, reached through 320 MHz channel bonding in the 6 GHz band and 4096-QAM modulation, which carries 12 bits per symbol against the 10 bits of Wi-Fi 6’s 1024-QAM ceiling. The release also adds 6 GHz Multi-Pre-Shared Key support, letting administrators assign a distinct passkey per device or group under one SSID instead of relying on a single shared passphrase that fails badly the moment one device is compromised.

OpenWiFi 4.0 also shipped with lab evidence behind it. Development and QA partners embeDD, Kinara Systems, and Candela Technologies covered more than 40 devices under test, Wi-Fi 6 and Wi-Fi 7 models alike, and put more than 12 of them through QA lab testing for peak throughput, TR-398 conformance, and roaming behavior. That testing discipline is a large part of why the OpenWiFi ecosystem had scaled to nearly 400,000 certified access points deployed worldwide by November 2025, spanning more than 80 compliant access point and LAN switch SKUs from multiple ODMs.

Scale like that stresses the layer most people never think about: identity. TIP’s 2025 mid-year review counted over 200,000 certificates issued for uCentral-enabled devices, with more than 20,000 created in March 2025 alone, before OpenWiFi 4.0 had even shipped. A radio upgrade and an identity system running at that volume were always going to collide.

Why the Wi-Fi 7 Wired Backhaul Keeps Landing on a Proprietary Switch

A Wi-Fi 7 access point running a full tri-radio configuration can generate more traffic than a single 1GbE uplink can carry, and it can draw enough power that it needs IEEE 802.3bt PoE++, beyond the PoE+ budget that satisfied the previous generation of access points. That is a straightforward capacity problem. The harder problem is what most operators reach for to solve it.

The default fix is a proprietary access switch bundled with a proprietary management license, sold by the same vendor whose lock-in wireless architects just spent a decade working around. It reproduces, port for port, the exact ownership model OpenWiFi’s disaggregated APNOS and CloudSDK design set out to eliminate on the radio side. The operator gets a faster uplink and a new dependency in the same box.

That dependency carries a cost structure most procurement teams recognize on sight: high upfront capital spend for vendor-locked hardware, followed by recurring operational spend for cloud management licenses, per-feature software keys, and support contracts that scale with device count rather than actual usage. Swap a switch vendor mid-contract and the management plane, the licensing terms, and often the staff training all move at once. All of that sits in the wired layer, and Wi-Fi 7’s bandwidth and power demands simply made it impossible to ignore.

How OpenLAN Rebuilt Trust Without One Vendor Holding the Keys

Every device on an OpenWiFi network authenticates through a public key infrastructure, and until recently that infrastructure ran through a single certificate authority: DigiCert, accessed through TIP’s own legacy certificate portal. According to TIP’s April 2026 account of the program, that arrangement, PKI 1.0, carried four structural problems the community couldn’t engineer around.

The DigiCert certificates were reaching expiry, and the lookup service behind them was scheduled for decommissioning by March 2026, a fixed deadline that put every deployed device at risk of losing its identity outright. PKI 1.0 had no automated certificate enrollment or renewal, so devices ran on static factory certificates with no dynamic re-keying path.

Controller discovery was wired directly into DigiCert’s own infrastructure, so trust verification and controller assignment couldn’t be operated as separate concerns. And moving hardware between cloud management vendors routinely broke the trust chain, a problem with no answer at all in air-gapped environments that had no standardized local trust model to fall back on.

The community’s fix, PKI 2.0, is worth understanding in some detail because the reasoning behind it applies well beyond Wi-Fi. The community first explored the Automated Certificate Management Environment (ACME) protocol, whose TLS challenge requires an inbound connection to the device and therefore an open listening port on every field-deployed access point. It settled on Enrollment over Secure Transport (EST, RFC 7030, an IETF standard since 2013), which operates entirely over client-initiated HTTPS.

A device authenticates outbound using its factory-installed “birth certificate,” with no inbound port ever exposed to the internet. The community ported Cisco’s open-source libest library directly into the access point firmware to make that work in practice.

On the certificate authority side, the community issued an RFP to six vendors, selected Insta in September 2024, and completed a Root CA ceremony in May 2025, standing up a multi-tiered X.509 hierarchy (a Root CA and three issuing CAs) with production endpoints in four regions (Virginia, California, Ireland, and Singapore) under the open-lan.org domain. Certificates now renew automatically at two-thirds of their lifetime, so a five-year operational certificate quietly renews itself around the 3.3-year mark, well before it can lapse.

Sitting alongside the CA is a new, independently built Cloud Discovery Service that decouples identity verification from controller lookup entirely: a serverless system on AWS Lambda and DynamoDB that authenticates devices over mutual TLS and maps each device’s MAC address to its assigned controller. The new CA and the discovery service together tie each device’s certificates, discovery data, and controller assignment back to one hardware identity, and let a network move between controller vendors without breaking device identity or trust.

The same rebuild also solved the air-gap problem PKI 1.0 never addressed. Operators can now run OpenLAN PKI 2.0 in environments with no external connectivity, so zero-touch provisioning still works inside an isolated network. For European operators working through the 2022 NIS2 Directive’s supply chain risk requirements, that capability carries direct weight: it is the difference between depending on one CA vendor’s uptime and jurisdiction, and controlling root keys locally.

The reasoning that justified rebuilding OpenWiFi’s identity layer around open, vendor-neutral infrastructure instead of one CA’s proprietary portal is the same reasoning that applies to the switch underneath the radio, which is the gap PLVision built SONiC Lite to close.

Where SONiC Lite Picks Up the Wired Half of the Stack

PLVision, a networking software engineering company working in open networking since 2007, with about 200 people across Poland and the EU, is a Telecom Infra Project member and one of the engineering teams adapting SONiC for TIP’s OpenLAN Switching (OLS) project, the wired-layer counterpart to OpenWiFi.

Community SONiC was built for hyperscale data center leaf-spine switches: heavy switching silicon, large memory footprints, and full BGP fabrics. None of that fits a cost-sensitive enterprise wiring closet, which is the mismatch PLVision engineered SONiC Lite to close: a resource-optimized distribution that, by PLVision’s own figures, needs 50 to 70% fewer resources than full-scale Community SONiC while keeping the campus-specific features an access switch actually needs.

The SONiC Lite product brief lists 2 ARM cores, 2 GB of RAM, and about 3 GB of storage.

SONiC Lite’s campus features map directly onto what a Wi-Fi 7 rollout requires from its wired layer: per-port IEEE 802.3af/at/bt PoE control up to PoE++ with remote power cycling, 802.1X port-based access control, the Layer 2 suite of PVST/xSTP, LACP, and 802.1Q VLAN tagging, and DHCP relay, plus zero-touch provisioning through controller certificates installed at the U-Boot stage, so a switch can authenticate and pull its configuration on first power-on the same way an OpenWiFi access point does.

PLVision and Edgecore Networks brought this to the Edgecore ECS4650-54P, a flagship OLS switch with 48 PoE++ ports and SONiC Lite pre-installed.

What that gives operators is a single management plane for both layers. Through the OpenWiFi Gateway (OWGW) microservice, administrators manage Wi-Fi 7 access points and OLS switches under the same uCentral data model. In a typical campus deployment, an access point connects to the ECS4650-54P, which delivers PoE++ over standard cabling while placing AP management traffic on its own VLAN and relaying 802.1X authentication requests to an upstream FreeRADIUS server on a separate segment.

If an access point hangs, an administrator can issue a targeted PoE power-cycle command from the OWGW interface, and the switch interrupts power to that one RJ-45 port long enough to force a physical reboot, with no technician dispatched to the site.

The economics follow the same disaggregation logic that made the radio side work: the savings come from eliminating the recurring licensing fees and hardware lock-in that come bundled with a proprietary switch.

And because SONiC Lite is available under a source-based license, security teams can audit the build directly rather than trusting a vendor’s word for it, a property that carries real weight in GDPR and NIS2 compliance reviews, alongside its day-to-day operational value.

What Network Teams Should Do Before a Wi-Fi 7 Rollout

Six checks keep the wired layer from undoing what the radio upgrade gains, and each one is cheapest to run before the purchase order goes out.

• Audit wired uplink and PoE budget before the Wi-Fi 7 rollout. Multi-radio Wi-Fi 7 access points can exceed a 1GbE uplink’s usable capacity and typically require full 802.3bt PoE++ per port. Confirm both figures against the specific AP models being deployed rather than assuming the existing switch fleet has headroom.
• Check where PKI 1.0 dependencies still exist in the deployed fleet. Devices that migrated from DigiCert-issued certificates should already be running on Insta-backed operational certificates through the EST re-enrollment path. Any device still presenting an expired legacy certificate needs to move through the recovery process before it becomes unreachable.
• Map the deployment against NIS2 supply chain requirements, GDPR, and the EU Data Act before renewal. Air-gapped local CA support and source-auditable software carry direct compliance value, and documenting them proactively is far easier than retrofitting the evidence under deadline pressure during an audit.
• Model total cost of ownership across the full hardware refresh cycle. PLVision’s TCO framework breaks the comparison into hardware, software, support, and engineering costs. Proprietary switch licensing and per-device management fees compound over a three-to-five-year period in ways that a comparison limited to the initial purchase price misses entirely.
• Treat the switch and the access point as one hardware compatibility list. Selecting an OLS-compliant switch alongside OpenWiFi-certified access points keeps both layers under one unified management plane instead of stitching together two separate vendor ecosystems after the fact.
• Build a recovery plan for devices that miss a migration window. Whether the migration in question is PKI 2.0 certificate renewal or a switch firmware update, plan for an offline recovery path for hardware that goes unreachable, rather than assuming every device will complete the transition on schedule.

Together, the six checks turn the switch from a line item chosen after the wireless design into part of the design itself, which is also the evidence trail a European buyer needs when digital sovereignty comes up in a compliance review.

The Switch Now Belongs to the Same Trust and Cost Equation as the Radio

OpenWiFi 4.0 and PKI 2.0 together demonstrate that disaggregation only holds up when it’s applied consistently. A network can run an open, vendor-neutral radio on top of a locked-down switch, or an open switch underneath a proprietary radio stack, but neither combination delivers what operators actually want, which is a network where no single vendor controls the exit.

The wired access layer was the obvious place for that inconsistency to persist, simply because nobody was forced to look at it until Wi-Fi 7’s power and bandwidth requirements made the old switch inadequate on its own terms. That forcing function is now in place, and the OpenLAN Switching project exists because of it.

What changes next is how deployment decisions get made. A wired switch now belongs to the same trust chain, the same management plane, and the same total cost of ownership calculation as the radios sitting on top of it, and it deserves to be evaluated that way from the start, before the wireless design is locked in.

PLVision engineers open, production-grade SONiC software across the data center, edge, and campus, including SONiC Lite and Embedded SONiC Lite for OEM access and campus switches, and PLVision LTS for SONiC® for production data center fabrics.