The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Christina Klam <cklam AT ias.edu>]

Alam,

Is this with Windows or all devices?   We had something similar happen when we replaced the certificate in August.   If this is just Windows, I will send you our workaround.

Christina Klam
Network Engineer
Institute for Advanced Study
1 Einstein Dr
Princeton, NJ 08540
(m) +1 609-751-7899
(o) +1 609-734-8154
cklam AT ias.edu

---

From: "Alam, Nahid /DZNE" <cat-users AT lists.geant.org>
To: "cat-users" <cat-users AT lists.geant.org>
Cc: "Uysal, Cueneyt /DZNE" <Cueneyt.Uysal AT dzne.de>, "Khan, Emrose /DZNE" <Emrose.Khan AT dzne.de>, "Hakimi, Hasibullah /DZNE" <Hasibullah.Hakimi AT dzne.de>, eduroam AT dfn.de, "Rocha Almeida, Jose /DZNE" <Jose.Almeida AT dzne.de>, "Baracchi, Laura /DZNE" <Laura.Baracchi AT dzne.de>
Sent: Tuesday, January 16, 2024 12:13:59 PM
Subject: RE: [[cat-users]] Eduroam certificate renewal

Dear Eduroam Support Team,

 

Recently we renewed our ISE certificate and after that our eduroams user are facing connectivity issue using eduroam CAT Application, we discovered that the authentication process is being rejected from our ISE. ISE log is showing Certificate issue TSL error as below.

 

 

Possible Resolution Ensure that the ISE server certificate is trusted by the client, by configuring the supplicant with the CA certificate that signed the ISE server certificate. It is strongly recommended to not disable the server certificate validation on the client!

Possible Root cause While trying to negotiate a TLS handshake with the client, ISE received an unexpected TLS alert message. This might be due to the supplicant not trusting the ISE server certificate for some reason. ISE treated the unexpected message as a sign that the client rejected the tunnel establishment.

 

Note that user can connect eduroam service directly using their username and credential without eduroam CAT application. Upon inspecting the eduroam CAT application profile, it has come to our attention that a specific/old root certificate has been hardcoded for end users, and unfortunately, this certificate has expired. We need to edit this profile and set the correct updated certificate then end user will able to connect eduroam service using eduroam CAT application. However, the process of editing the application profile is currently unknown to us, and we are seeking your assistance in guiding us through the necessary steps. Your expertise and support in resolving this matter would be greatly appreciated.

 

 

End User eduroam CAT application profile settings which is hardcoded with old certificate is given below.

 

 

 

 

Thanking you,

 

Khandakar Nahid Alam

Network & Cyber Security Engineer

 

Deutsches Zentrum für Neurodegenerative Erkrankungen e. V. (DZNE)

Venusberg-Campus 1/99 
53127 Bonn 

Mail: nahid.alam AT dzne.de

Web: www.dzne.de 

 

 

*********************************

Vorstand: Prof. Pierluigi Nicotera, MD PhD (Vorstandsvorsitzender und Wissenschaftlicher Vorstand)

und Dr. Sabine Helling-Moegen, LL.M. (Administrativer Vorstand).

Das DZNE ist im Vereinsregister des Amtsgerichts Bonn eingetragen (VR 9021).

To unsubscribe, send this message: mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users