The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Tomasz Wolniewicz <address@concealed>]

Hi,

   You must include the root in the config. This is needed for the installers to tell the client system which CA to trust. Contrary to the browser world, in 802.1x the system only trusts selected roots and only servers signed under this root which have a particular name.

Depending on the system, the root may be installed somewhere or skipped. For instance Windows installers will first test if they find the root (either in computer or user store) and if they do, the will just skip the installation. The trust (in the Windows case) is set by the CA fingerprint, CAT will get that fingerprint from the root you provide and push this into the profile.

Best

Tomasz

W dniu 08.10.2018 o 19:17, IAM David Bantz pisze:

Our network team has set up new RADIUS servers with cert signed by "well-known" (InCommon / Comodo) root CA.

Should I still be attempting to build installers including that CA? Or can I / should I leave out the rootCA portion of CAT config? Leaving out I guess means relying on the OS or browser store of trusted certs - will the CAT installed profiles do that reliably?

David Bantz

UAlaksa OIT IAM

To unsubscribe, send this message: mailto:address@concealed?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users

-- 
Tomasz Wolniewicz    
          address@concealed        http://www.home.umk.pl/~twoln

Uczelniane Centrum Informatyczne   Information&Communication Technology Centre
Uniwersytet Mikolaja Kopernika     Nicolaus Copernicus University,
pl. Rapackiego 1, Torun               pl. Rapackiego 1, Torun, Poland
tel: +48-56-611-2750     fax: +48-56-622-1850       tel kom.: +48-693-032-576