The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> The Static Connectivity Test of the Realm Testing tool
> (https://cat.eduroam.org/diag/action_realmcheck.php) compares RADIUS
> server certificate name (CN) against profile-defined server names using
> _case-sensitive_ comparison, giving false errors when case does not match.
> 
> (or are there any devices that have problem with this?...)

There may well be. Certificate name comparison is a topic with a long
history. The Subjects (incl. CN) of CAs are for example case sensitive
during chain building.

subjectAltNames of type DNS are required to be compared in a
MatchIgnoreCase manner, but I did not find anywhere in RFC5280 that the
CN part of a Subject DN is guaranteed to benefit from the same treating.

IMHO, if you configuring in CAT a different capitalisation than what you
actually send in the server certificate, you are actively looking for
unpleasant surprises. Warning against that is IMHO a good thing to do. I
certainly wouldn't consider this a bug.

And fixing is it easy: in CAT, configure the name in the same
capitalisation as the one you have in your cert.

Greetings,

Stefan Winter


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature