A wireless local area network system establishes a PASSPOINT™ connection between a mobile station and a hotspot using an enhanced single SSID method or an enhanced dual SSID method. In the dual SSID method, an access point associates and authenticates a mobile device to a secondary SSID of the access point during enrollment and provisioning. After enrollment, the access point authenticates the mobile station to a primary SSID of the access point using the credential that the mobile station received from an online sign-up (“OSU”) server in connection with the secondary SSID. In the single SSID method, an access point performs two levels of authentication. During authentication, communications are limited to an 802.1x controlled port running on the mobile station and access point. After a first authentication, communications between the OSU server and the mobile station are unblocked. After the second authentication, all traffic from the mobile station is unblocked.