The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

["Herivault, Jacques" <herivault.jacques AT uqam.ca>]

Hello,

 

In our recent experience changing our certificates, we had to remove profiles manually on all devices (IOS, MacOS, Android and Windows). We will be facing a pretty huge support rush in the fall when the semester starts and students and faculty come back on campus.

 

As I have said, with our Windows 10 machines, once the old profile was removed, installation of the new profile went smoothly, but for Windows 11 machines, to make a proper connexion, the choice of certificate had to be done manually in the EAP properties to make it work (as shown in the screenshot I sent earlier, I have included it with this email as well).

 

Regards,

____________________________________________________________

Jacques Hérivault

Chargé de projet TI

Services informatiques – Direction des réseaux

herivault.jacques AT uqam.ca

514-987-3000 poste 2576

      servicesinformatiques.uqam.ca

 

 

De : Tomasz Wolniewicz <twoln AT umk.pl>
Date : jeudi, 22 mai 2025 à 17:32
À : Herivault, Jacques <herivault.jacques AT uqam.ca>, Stefan Paetow <Stefan.Paetow AT jisc.ac.uk>, cat-users AT lists.geant.org <cat-users AT lists.geant.org>
Objet : Re: [[cat-users]] Cat-signer-ams.eduroam.org certificat expirering on May 30 2025

Hi,

 I think I would like to get more information about this difference between Windows 11 and Windows 10. If you change the certificates in the CAT profiles and the user run the new installers then the installer will remove the old profile and install the new one pointing to the new root certificate. I cannot imagine how Windows 11 can differ from Windows 10 here.

Yours

Tomasz

 

 

W dniu 22.05.2025 o 20:32, Herivault, Jacques pisze:

Hello,

 

To follow up on why I asked this question originally, it was because we just changed our certificate chain for our users with a good impact on them.

 

For your information, since all our users had to change their CAT profiles to get the new chain, we have had to adjust our user documentation for Windows 11 because now it seems that these CAT users need to go into the EAP properties to select the root certificate for the connection to work. Windows 10 users do not have to do this.

 

This does not seem to be a proper manipulation to impose on users. Either the executable needs to be adjusted or a Windows 11 package needs to be created.

 

Regards,

____________________________________________________________

Jacques Hérivault

Chargé de projet TI

Services informatiques – Direction des réseaux

herivault.jacques AT uqam.ca

514-987-3000 poste 2576

      servicesinformatiques.uqam.ca

 

 

De : cat-users-request AT lists.geant.org <cat-users-request AT lists.geant.org> de la part de Tomasz Wolniewicz <cat-users AT lists.geant.org>
Date : jeudi, 22 mai 2025 à 08:17
À : Stefan Paetow <Stefan.Paetow AT jisc.ac.uk>, cat-users AT lists.geant.org <cat-users AT lists.geant.org>
Objet : Re: [[cat-users]] Cat-signer-ams.eduroam.org certificat expirering on May 30 2025

Hi Stefan,

 your answer probably comes out of a confusion. The certificate in question was for signing the mobileconfig not the Windows exe. While Windows installers are signed with the use of timestamping and the validity of the signature does not expire with the validity of the signing certificate itself, for mobileconfig we have not been using timestamping (so far) and the the expired cert will generate a warning from the Apple system.

We are looking into the possibility of timestamping these as well.

Cheers

Tomasz

 

W dniu 22.05.2025 o 12:00, Stefan Paetow (via cat-users Mailing List) pisze:

Ciao Daniele,

 

No, the signing does not prevent people from using the installers. The certificate is used to sign the executable, which allows a user to verify that it comes from a reputable (i.e. CAT) source and that it's not been tampered with.

 

So users won't see anything different, unless they right-click and look at the signing information in the Properties menu.

 

With kind regards

 

Stefan Paetow

Federated Roaming Technical Specialist

eduroam(UK), Jisc

 

email/teams: stefan.paetow AT jisc.ac.uk

gpg: 0x3FCE5142

 

For eduroam support, please contact the eduroam team via help AT jisc.ac.uk and mark it for eduroam’s attention.

Until 31 July, I am not available on Mondays, and also not on Fridays between 12:00 and 15:00 London time (UTC in winter, UTC+0100 in summer).

 

Note: I don’t expect a reply outside of your working hours, since I work internationally with colleagues in different nationalities with different religions, customs, and holidays. Reply when it is convenient for you.

 

Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

 

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

 

For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

 

 

From: <cat-users-request AT lists.geant.org> on behalf of "ALBRIZIO DANIELE (via cat-users Mailing List)" <cat-users AT lists.geant.org>
Reply to: ALBRIZIO DANIELE <albrizio AT units.it>
Date: Thursday, 22 May 2025 at 10:44
To: Tomasz Wolniewicz <twoln AT umk.pl>, "cat-users AT lists.geant.org" <cat-users AT lists.geant.org>, "herivault.jacques AT uqam.ca" <herivault.jacques AT uqam.ca>
Cc: "ruel.ian AT uqam.ca" <ruel.ian AT uqam.ca>
Subject: Re: [[cat-users]] Cat-signer-ams.eduroam.org certificat expirering on May 30 2025

 

 

I think Jacques Hérivault, asking "please advise on what impact we must face when it will be renewed" meant what impact on users and helpdesk we must face.

 

Is it correct to say that users with an installer downloaded before yesterday will not be able to run it after  May 30 2025 and they will get a non proceed warning about certificate expiration?

 

On Wed, 2025-05-21 at 19:01 +0200, Tomasz Wolniewicz wrote:

Hi,

   the signing certificate has been renewed and all downloaded mobileconfig files will be signed with the new ones.

Yours

Tomasz Wolniewicz

 

W dniu 19.05.2025 o 17:26, "Herivault, Jacques" (via cat-users Mailing List) pisze:

 

Hello,

 

The cat-signer-ams.eduroam.org certificat that is included in our CAT Eduroam profils downloaded on our users devices is expirering on May 30 2025.

 

Could you please advise on what impact we must face when it will be renewed ?

 

Thank you.

 

Regards,

____________________________________________________________

Jacques Hérivault

Chargé de projet TI

Services informatiques – Direction des réseaux

herivault.jacques AT uqam.ca

514-987-3000 poste 2576

      servicesinformatiques.uqam.ca

 

To unsubscribe, send this message: mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users

 

-- 

 

---

Daniele Albrizio

Ufficio Reti e Telefonia | Networks and Telephony Office
Università degli Studi di Trieste | University of Trieste
Via Alfonso Valerio 12 - 34127 Trieste (Italy)
daniele.albrizio AT units.it
Tel. | Ph. +39 040 558 3319

Ufficio Reti e Telefonia | Networks and Telephony Office
Tel. | Ph. +39 040 558 3331

To unsubscribe, send this message: mailto:sympa AT lists.geant.org?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users

-- 

Tomasz Wolniewicz

-- 

Tomasz Wolniewicz

Attachment: Capture d’écran 2025-05-20 094430.png
Description: Capture d’écran 2025-05-20 094430.png