The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> We’ve migrated our Wi-Fi at the University of New Brunswick (Canada) to
> eduroam only. We’re trying to streamline connectivity for our
> faculty/staff and students and have been promoting the eduroam CAT.
> We’re having issues with the app on Android.
> 
> If you set it up on the device, it just continually tries to connect.
> Once you stop, and then go in to the wireless settings on the device,
> you can connect, if you do not validate the certificate.
> 
> It works for all other operating systems. Has anyone else had this
> issue, and if so, were you able to resolve it?
> 
> We are using PEAP with Pase2:MSCHAPv2.
> 
> I’m asking on behalf of my team, so if you get too technical, I’ll pass
> on the question 😊

Your server certificate is issued by an intermediate CA, which in turn
ends in a root CA.

For Android, it is only possible to load root CAs onto the device, not
intermediates.

The intermediate is however /required/ for certificate validation to work.

The only way to make this happen is by making sure the RADIUS server
sends that intermediate certificate during the EAP exchange. If it is
*only* sending the server certificate, the behaviour you describe occurs.

If that's the issue, then you should have a corresponding warning in the
admin area of CAT when running the realm reachability tests. Is that so?

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature