iPhone not reconnecting to WiFi network

Hello Guys,
i’m facing a very strange issue here. i do have a wifi network managed by capman and 3 wap ac in cap mode.
all is working good from any devices except apple ones.
When it comes to connect an iphone, its not recognizing the PSK, even if i’m sure its correct.
A workaround is scanning the network QRCODE generated on another device, that trik will make the iphone connecting to the network.
anyway, the trick is one shot. if that iphone device leave the netork, and come back in the range lets say 24h later it will need to scan the qr again to reconnect to the network.

is it anyone facing similar issues? here my capsman conf

[admin@RouterOS] > /interface/wifi/capsman/ print 
                   enabled: yes
                interfaces: bridge-wifi-tunnel
            ca-certificate: auto
  require-peer-certificate: no
              package-path: 
            upgrade-policy: suggest-same-version
  generated-ca-certificate: WiFi-CAPsMAN-CA-789A180E26B0
     generated-certificate: WiFi-CAPsMAN-789A180E26B0
[admin@RouterOS] > /interface/wifi/configuration/ print 
Flags: X - disabled 
 0   name="cfg-wifi2-2GHZ" ssid="Mao-Fi" country=Italy multicast-enhance=enabled security=sec1 
     security.connect-priority=0 
     interworking=interworking1 datapath=datapath-wifi2-tunnel channel=2_Ghz steering=steering1 

 1   name="cfg-wifi2-5GHZ" ssid="Mao-Fi" country=Italy multicast-enhance=enabled security=sec1 
     security.connect-priority=0 
     interworking=interworking1 datapath=datapath-wifi2-tunnel channel=5_Ghz_AC steering=steering1 

[admin@RouterOS] > /interface/wifi/security/ print
Flags: X - disabled 
 0   name="sec1" authentication-types=wpa2-psk,wpa3-psk passphrase="***" connect-priority=0 
[admin@RouterOS] > /interface/wifi/interworking/ print
Flags: X - disabled 
 0   name="interworking1" network-type=private internet=yes venue=residential-private ipv4-availability=single-nated ipv6-availability=not-available domain-names=mao.onl wan-status=up 
[admin@RouterOS] > /interface/wifi/datapath/print     
Columns: NAME, BRIDGE
# NAME                   BRIDGE            
0 datapath-wifi2-tunnel  bridge-wifi-tunnel
[admin@RouterOS] > /interface/wifi/channel/ print 
Flags: X - disabled 
 0   name="5_Ghz_AC" band=5ghz-ac 

 1   name="2_Ghz" band=2ghz-n 
[admin@RouterOS] > /interface/wifi/steering/ print
Flags: X - disabled 
 0   name="steering1" neighbor-group=dynamic-Mao-Fi-538252a9 rrm=yes wnm=yes 
[admin@RouterOS] > /system/
backup     console                   device-mode     history      leds        logging     ntp         resource        rtrace        script      watchdog               export     reset-configuration     shutdown     ssh-exec       telnet   
clock      default-configuration     health          identity     license     note        package     routerboard     scheduler     upgrade     check-installation     reboot     serial-terminal         ssh          sup-output     
[admin@RouterOS] > /system/
..
[admin@RouterOS] > /system/package/ print
Columns: NAME, VERSION, BUILD-TIME, SIZE
# NAME      VERSION  BUILD-TIME           SIZE  
0 routeros  7.14     2024-02-29 11:44:44  9.3MiB

admin@RouterOS] > /interface/wifi/actual-configuration/ print
 0 name="cap-wifi1" mac-address=18:FD:74:D2:45:7E arp-timeout=auto radio-mac=18:FD:74:D2:45:7E 
   configuration.ssid="Mao-Fi" .country=Italy .multicast-enhance=enabled 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="***" .connect-priority=0 
   interworking.network-type=private .internet=yes .venue=residential-private .ipv4-availability=single-nated .ipv6-availability=not-available .domain-names=mao.onl .wan-status=up 
   datapath.bridge=bridge-wifi-tunnel 
   channel.band=2ghz-n 
   steering.neighbor-group=dynamic-Mao-Fi-538252a9 .rrm=yes .wnm=yes 

 1 name="cap-wifi2" mac-address=18:FD:74:D2:45:7F arp-timeout=auto radio-mac=18:FD:74:D2:45:7F 
   configuration.ssid="Mao-Fi" .country=Italy .multicast-enhance=enabled 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="***" .connect-priority=0 
   interworking.network-type=private .internet=yes .venue=residential-private .ipv4-availability=single-nated .ipv6-availability=not-available .domain-names=mao.onl .wan-status=up 
   datapath.bridge=bridge-wifi-tunnel 
   channel.band=5ghz-ac 
   steering.neighbor-group=dynamic-Mao-Fi-538252a9 .rrm=yes .wnm=yes 

 2 name="cap-wifi3" mac-address=18:FD:74:D2:40:3D arp-timeout=auto radio-mac=18:FD:74:D2:40:3D 
   configuration.ssid="Mao-Fi" .country=Italy .multicast-enhance=enabled 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="***" .connect-priority=0 
   interworking.network-type=private .internet=yes .venue=residential-private .ipv4-availability=single-nated .ipv6-availability=not-available .domain-names=mao.onl .wan-status=up 
   datapath.bridge=bridge-wifi-tunnel 
   channel.band=2ghz-n 
   steering.neighbor-group=dynamic-Mao-Fi-538252a9 .rrm=yes .wnm=yes 

 3 name="cap-wifi4" mac-address=18:FD:74:D2:40:3E arp-timeout=auto radio-mac=18:FD:74:D2:40:3E 
   configuration.ssid="Mao-Fi" .country=Italy .multicast-enhance=enabled 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="***" .connect-priority=0 
   interworking.network-type=private .internet=yes .venue=residential-private .ipv4-availability=single-nated .ipv6-availability=not-available .domain-names=mao.onl .wan-status=up 
   datapath.bridge=bridge-wifi-tunnel 
   channel.band=5ghz-ac 
   steering.neighbor-group=dynamic-Mao-Fi-538252a9 .rrm=yes .wnm=yes 

 4 name="cap-wifi5" mac-address=18:FD:74:D2:46:6B arp-timeout=auto radio-mac=18:FD:74:D2:46:6B 
   configuration.ssid="Mao-Fi" .country=Italy .multicast-enhance=enabled 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="***" .connect-priority=0 
   interworking.network-type=private .internet=yes .venue=residential-private .ipv4-availability=single-nated .ipv6-availability=not-available .domain-names=mao.onl .wan-status=up 
   datapath.bridge=bridge-wifi-tunnel 
   channel.band=2ghz-n 
   steering.neighbor-group=dynamic-Mao-Fi-538252a9 .rrm=yes .wnm=yes 

 5 name="cap-wifi6" mac-address=18:FD:74:D2:46:6C arp-timeout=auto radio-mac=18:FD:74:D2:46:6C 
   configuration.ssid="Mao-Fi" .country=Italy .multicast-enhance=enabled 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="***" .connect-priority=0 
   interworking.network-type=private .internet=yes .venue=residential-private .ipv4-availability=single-nated .ipv6-availability=not-available .domain-names=mao.onl .wan-status=up 
   datapath.bridge=bridge-wifi-tunnel 
   channel.band=5ghz-ac 
   steering.neighbor-group=dynamic-Mao-Fi-538252a9 .rrm=yes .wnm=yes 
[admin@RouterOS] >

Make an SSID with no encryption. See if it connects then.

I don’t know what you do but I see a lot of things that I don’t use and currently my network works better than ever with version 14

[user1@hAPax3] > interface/wifi/actual-configuration/print
 0 name="cap-wifi1" mac-address=48:A9:8A:4C:2A:29 arp-timeout=auto radio-mac=48:A9:8A:4C:2A:29 

 1 name="hAP-ax2_5" mac-address=48:A9:8A:4C:2A:28 arp-timeout=auto radio-mac=48:A9:8A:4C:2A:28 
   configuration.mode=ap .ssid="pepe" .country=Spain .tx-power=20 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="pasword" .wps=disable .ft=yes .ft-over-ds=yes .connect-priority=0/1 
   channel.frequency=5580,5180 .width=20/40mhz 

 2 ;;; 5GHz
   name="wifi1" l2mtu=1560 mac-address=48:A9:8A:BD:F3:65 arp-timeout=auto radio-mac=48:A9:8A:BD:F3:65 
   configuration.mode=ap .ssid="pepe" .country=Spain .tx-power=20 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="pasword" .wps=disable .ft=yes .ft-over-ds=yes .connect-priority=0/1 
   channel.frequency=5660,5220 .width=20/40mhz 

 3 ;;; 2.4GHz
   name="wifi2" mtu=1500 l2mtu=1560 mac-address=48:A9:8A:BD:F3:66 arp-timeout=auto radio-mac=48:A9:8A:BD:F3:66 
   configuration.mode=ap .ssid="pepe" .country=Spain 
   security.authentication-types=wpa2-psk,wpa3-psk .passphrase="pasword" .wps=disable .ft=yes .ft-over-ds=yes .connect-priority=0/1 
   channel.frequency=2462 .width=20mhz