The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[address@concealed]

Hi,

>    I'm confused, how can you expect your client supplicants to trust a 
> RADIUS
>    server they know nothing about? 

its quite easy.

the client is configured (eg by eduroamCAT or any other deployment tool....or 
by hand
if really need to) to trust a CA (and a server commonname)

the RADIUS server that is at the other end of the 802.1X authentication 
provides
its cert (and intermediates) to the client.

using the intermediates, the client is able to build a train of trust to that 
of the server
so it can trust the server - its signed by the known/selected CA and has the 
commonname
expected too. 

this is how x509 works...its how HTTPS etc work too.... though in that world, 
public certificate
companies pay OS vendors etc to ensure their CAs are installed so when users 
browse sites
that are signed by those CAs it works.

alan