The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Tomasz Wolniewicz <twoln AT umk.pl>]

Hi,

   cat-test is really for testing new software versions, so we did not
pay enough attention to have the signing certs in  order, but we will do
that, thnk you for reporting.

  To do what you want to test now I would suggest that you use the
production CAT and create a new profile with production-ready flag set
to off. This profile can then have you new certificate. It will not be
visible to your users but as the admin you will be able to download the
installers in their final form and test them.

Tomasz


W dniu 03.02.2020 o 12:02, Jan Reister pisze:
> Hello list,
>
> we are using cat-test.eduroam.org to test a new certificate issued by
> DigiCert and TERENA. We plan to deploy the new certificate soon as the
> existing cert on cat.eduroam.org for our university is expiring.
>
> The deployment via cat-test of the certificate on iOS fails as the
> profile is "unverified". Profile details show two signing certificates,
> one valid by TERENA, and another by GEANT which is *expired*.
>
> See attached pics.
>
> We extracted certificates from the .mobileconfig file and verified that
> the certificate chain is correct.
>
> $ openssl verify -verbose -CAfile RootCAFile -untrusted
> IntermediateCAFile CertificateFile
> $ CertificateFile: OK
>
> We can't find any reference to the GEANT signature on the certificate
> chain.
> Looks like the .mobileconfig generator on cat-test works correctly.
> Somehow seems that iOS picks up the GEANT signing certificate which is
> expired, and ignores the TERENA signing certificate.
>
> We tried turning it off and on again(R), to no avail :-)
>
> Do you have any idea why is this happening?
>
> Thank you for your attention,
>
> Jan and Claudio

-- 
Tomasz Wolniewicz    
          twoln AT umk.pl        http://www.home.umk.pl/~twoln

Uczelniane Centrum Informatyczne   Information&Communication Technology Centre
Uniwersytet Mikolaja Kopernika     Nicolaus Copernicus University,
pl. Rapackiego 1, Torun            pl. Rapackiego 1, Torun, Poland
tel: +48-56-611-2750     fax: +48-56-622-1850       tel kom.: +48-693-032-576

Attachment: smime.p7s
Description: Kryptograficzna sygnatura S/MIME