The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

I believe this is an issue that has to do with the CA operator itslef.
The Comodo CAs were at one point in time re-signed from being a root to
an intermediate, and there are Windows 10 machines out there which have
it installed as a root still (or vice versa). When given conflicting
information about a CA, Windows errs on the side of caution and fails
chain validation.

Please take a look at the Internet2 wiki regarding certificate chains:

https://spaces.internet2.edu/display/ICCS/InCommon+Cert+Types

According to that, the InCommon RSA Server CA (intermediate) is signed
by the UserTrust Secure (root) CA.

But there is a link to an alternate reality: "Comodo's version of the
chain".

That alternate one is the one you have uploaded to CAT.

Maybe you have more luck by uploading the one from the Internet2 wiki
instead. Or maybe you have to upload both, to make all variants of trust
stores on Windows happy.

Please let the list know which variant worked for you.

Greetings,

Stefan Winter

Am 10.05.2018 um 15:34 schrieb Schwartz, Roger J:
> We have configuring the CAT Tools for our campus. Windows machines are
> giving us the following error during our testing:
> 
> Thu Mar 15 13:57:03 2018 : Auth: (83134368) Login incorrect (eap_peap:
> 
>      > TLS Alert read:fatal:access denied): [rschwart/<via Auth-Type = eap>]
> 
>      > (from client alexander-wlc port 13 cli 9c:b6:d0:e1:9f:b7)
> 
>  
> 
> Below is the screen cap from our certificate Global EAP Options.
> 
>  
> 
>  
> 
> We do not have any issues with the Mac OSX machines. Is there something
> special we need to do for the CAT Tool to work with Windows 10 machines?
> 
>  
> 
> Thanks
> 
>  
> 
> *___________________________________________________________________________*
> 
> *Roger Schwartz *|Senior Wireless Network Technician/| /*Information
> Technology Services*
> 
> *UNIVERSITY OF TENNESSEE HEALTH SCIENCE CENTER*
> 
> 877 Madison Ave., Suite 738 | Memphis, TN  38163
> 
> ( 901.448.2236 | 7 901.448.8199 |*: address@concealed
> <mailto:address@concealed>
> 
>  
> 
> To unsubscribe, send this message:
> mailto:address@concealed?subject=unsubscribe%20cat-users
> Or use the following link:
> https://lists.geant.org/sympa/sigrequest/cat-users


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature