The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Martin Pauly <pauly AT hrz.uni-marburg.de>]

Hi all,

as we all know, changing the root of a given CA is no fun.
One reason for this is that with mobile devices, we hardly have
any device management (MDM) at all (much like PCs in the 1990ies).
Given that the use of CAT on most platforms involves the invocation
of some piece of software: Couldn't we use this to implement some
automatic check for updated profile settings on the server?

So if e.g. the Android app installed some kind of cronjob/task that
does a daily check for new .eapconfig profiles on cat.eduroam.org,
would this work? IMHO, at the very least, the app could nag the user
about the update or even go ahead and start the installation.

My background is, of course, the current change of root cert for
all German universities, affecting roughly 3 million people.
Most of us use a cert fork which is easily prepared in Freeradius,
but has to be triggered by the client using a special outer ID.
Now everyone has to tell their thousands of clients that they
should take action _before_ the root cert expires.
This turns out a hard job because users simply don't care as long
as things work. A little brat inside of the device might help
the situation...

I also see limits with this approach (e.g. Apple), but would it make sense at 
all?

Cheers, Martin

--
  Dr. Martin Pauly     Phone:  +49-6421-28-23527
  HRZ Univ. Marburg    Fax:    +49-6421-28-26994
  Hans-Meerwein-Str.   E-Mail: pauly AT HRZ.Uni-Marburg.DE
  D-35032 Marburg