The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Andrew Moase <amoase AT wlu.ca>]

Hi Stefan,

Great, thanks very much, that got me the information I need.

It looks like the certutil command being called is throwing an "CertUtil: 
-addstore command FAILED: 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)" when 
trying to process that cert. I'm still looking into why that is at this 
point, given that the two other certs the tool installs are able to be added 
successfully with no issues. If I find an answer I'll let you know, just in 
case anyone else runs into this.

Thanks very much for the info,

Andrew

-----Original Message-----
From: Stefan Winter <stefan.winter AT restena.lu> 
Sent: July 29, 2019 2:47 AM
To: Andrew Moase <amoase AT wlu.ca>; cat-users AT lists.geant.org
Subject: Re: [[cat-users]] Does the CAT tool generate logs or can it be 
configured to do so?

Hello,

> The error involves the 2nd cert that the CAT tool tries to install, 
> and> the message that pops up is "could not install certificate
cert-1.crt"> (also, image attached)

FWIW, cert-1 is the root certificate from Entrust. cert-0 and cert-2 are the 
two intermediate certificates. So your problem seems to be specifically with 
installing a root.

> Given the testing I've done so far, I believe the issue lies with 
> something in our standard windows 10 image that gets deployed (as the 
> error only occurs on systems with that image installed, all others 
> operate as expected). Oddly enough, even given the error, the tool 
> finishes running when the error is dismissed and the connection does 
> appear to be configured correctly.
> 
> Are any logs generated by the CAT tool that might indicate the error 
> it's encountering when it tries to install the cert, or is there an 
> option to have the installer generate logs in particular instances?

To do that you need to open the CMD window, go to the directory where the 
installer is located and call it with the -DEBUG=4 flag.

It will then produce a log file and it will also leave its files in the 
temporary directory, one could then in principle be able to install them 
manually and see.

Greetings,

Stefan Winter

--
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la 
Recherche 2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's 
key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66