The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Martin Stanislav <ms AT uakom.sk>]

Dear Alam,

Your org. needs to adjust its profile(s) on eduroam CAT portal [1]
in case it's about to change the root CA used to issue a replacement
EAP server certificate. Ideally add the new root CA to the published
configuration profiles long enough before introducing the changes
in the AAA infrustucture on your RADIUS server (a fair share of client
devices accept multipe root CA in their supplicant setup nowadays).
This way the end users get a chance to setup their devices in a way
that reflects comming changes in the infrastructure.

Should you have lost admin acceess to the eduroam CAT portal
DFN [1] is your most likely point of contact to resume the access.

Kind regards,
Martin

[1] A guide to eduroam CAT for IdP administrators
 
https://wiki.geant.org/display/H2eduroam/A+guide+to+eduroam+CAT+for+IdP+administrators

[2] https://www2.dfn.de/dienstbeschreibungro

On Tue, Jan 16, 2024 at 05:13:59PM +0000, "Alam, Nahid /DZNE" wrote:
> Dear Eduroam Support Team,
> 
> Recently we renewed our ISE certificate and after that our eduroams user 
> are facing connectivity issue using eduroam CAT Application, we discovered 
> that the authentication process is being rejected from our ISE. ISE log is 
> showing Certificate issue TSL error as below.
> 
> [cid:image005.png AT 01DA48A7.B39A67B0]
> 
> Possible Resolution Ensure that the ISE server certificate is trusted by 
> the client, by configuring the supplicant with the CA certificate that 
> signed the ISE server certificate. It is strongly recommended to not 
> disable the server certificate validation on the client!
> 
> Possible Root cause While trying to negotiate a TLS handshake with the 
> client, ISE received an unexpected TLS alert message. This might be due to 
> the supplicant not trusting the ISE server certificate for some reason. ISE 
> treated the unexpected message as a sign that the client rejected the 
> tunnel establishment.
> 
> Note that user can connect eduroam service directly using their username 
> and credential without eduroam CAT application. Upon inspecting the eduroam 
> CAT application profile, it has come to our attention that a specific/old 
> root certificate has been hardcoded for end users, and unfortunately, this 
> certificate has expired. We need to edit this profile and set the correct 
> updated certificate then end user will able to connect eduroam service 
> using eduroam CAT application. However, the process of editing the 
> application profile is currently unknown to us, and we are seeking your 
> assistance in guiding us through the necessary steps. Your expertise and 
> support in resolving this matter would be greatly appreciated.
> 
> 
> End User eduroam CAT application profile settings which is hardcoded with 
> old certificate is given below.
> 
> [cid:image001.jpg AT 01DA4880.995EEDC0]
> 
> 
> 
> Thanking you,
> 
> Khandakar Nahid Alam
> Network & Cyber Security Engineer
> 
> Deutsches Zentrum für Neurodegenerative Erkrankungen e. V. (DZNE)
> Venusberg-Campus 1/99
> 53127 Bonn
> Mail: nahid.alam AT dzne.de<mailto:nahid.alam AT dzne.de>
> Web: www.dzne.de<http://www.dzne.de/>
> 
> [signature_122933437]
> *********************************
> Vorstand: Prof. Pierluigi Nicotera, MD PhD (Vorstandsvorsitzender und 
> Wissenschaftlicher Vorstand)
> und Dr. Sabine Helling-Moegen, LL.M. (Administrativer Vorstand).
> Das DZNE ist im Vereinsregister des Amtsgerichts Bonn eingetragen (VR 9021).
> To unsubscribe, send this message: 
> mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
> Or use the following link: 
> https://lists.geant.org/sympa/sigrequest/cat-users