The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> We have installed our new certificate for eduroam this year and are
> facing an issue whereby the new certificate Root and Intermediate
> Certificates are not trusted by the eduroam CAT Tool, see output of the
> error we get when importing the certificate into the CAT Tool:
> 
> ‘/Client certificate: CA-N, non-accredited/
> /(CA: DC=hr/DC=eduroam/DC=MaliPero PKI 1)/
> /* correct certificate, expected result: FAI>
> /Server did not accept this client certificate: unknown authority or no
> certificate policy or another problem (elapsed time: 103 ms.)’/
> 
> The above is the output we get when importing both the intermediate and
> root certificates or eduroam into the CAT tool.
> 
> We never had this issue last year, only thing that has changed is the
> root and intermediate certs now use the new G3 certificates provided by
> JANET, has anyone experienced this issue and know the fix?

There is no issue at all. The output you pasted here corresponds to the
tests run to test "dynamic routing" reachability. It is something your
NRO (Jisc) sets up and administers for you.

The test includes checks whether the dynamic discovery endpoint will
rightly refuse to accept certificates which aren't accredited for
dynamic routing. You can see that this is not about your certificate
because the (rightly) refused certificate in question is
DC=hr/DC=eduroam/DC=MaliPero PKI 1.

The checks pertaining to your own server's EAP certificate are in the
tab "Static reachability". Only if you see errors on that tab, you have
an issue with your local setup.

For the tests on the "Dynamic" tab which you posted, you should only
inquire at your NRO if you see any of the two situations:

failure for "expected result: PASS"
success for "expected result: FAIL"

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature