The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Jan Reister <address@concealed>]

Hello list,

we are using cat-test.eduroam.org to test a new certificate issued by
DigiCert and TERENA. We plan to deploy the new certificate soon as the
existing cert on cat.eduroam.org for our university is expiring.

The deployment via cat-test of the certificate on iOS fails as the
profile is "unverified". Profile details show two signing certificates,
one valid by TERENA, and another by GEANT which is *expired*.

See attached pics.

We extracted certificates from the .mobileconfig file and verified that
the certificate chain is correct.

$ openssl verify -verbose -CAfile RootCAFile -untrusted
IntermediateCAFile CertificateFile
$ CertificateFile: OK

We can't find any reference to the GEANT signature on the certificate
chain.
Looks like the .mobileconfig generator on cat-test works correctly.
Somehow seems that iOS picks up the GEANT signing certificate which is
expired, and ignores the TERENA signing certificate.

We tried turning it off and on again(R), to no avail :-)

Do you have any idea why is this happening?

Thank you for your attention,

Jan and Claudio
-- 
Jan Reister - CWNA
tel +39 02 50315307
Servizio Wireless - Ufficio Architettura di Rete - Settore Reti
Direzione ICT
Università degli Studi di Milano

Attachment: profile1.jpg
Description: JPEG image

Attachment: profile2.jpg
Description: JPEG image