The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Paetow <address@concealed>]

Ciao Alessandro, 

It looks like your certificate chain is incorrect:

TLS: Certificate verification failed, error 19 (self signed certificate in certificate chain) depth 2 for '/C=GR/O=Hellenic Academic and Research Institutions CA/CN=HARICA TLS RSA Root CA 2021'

CTRL-EVENT-EAP-TLS-CERT-ERROR reason=1 depth=2 subject='/C=GR/O=Hellenic Academic and Research Institutions CA/CN=HARICA TLS RSA Root CA 2021' err='self signed certificate in certificate chain'

EAP: Status notification: remote certificate verification (param=self signed certificate in certificate chain)

OpenSSL: TX ver=0x0 content_type=256 (TLS header info/)

OpenSSL: Message - hexdump(len=5): 15 03 03 00 02

OpenSSL: TX ver=0x303 content_type=21 (alert/)

OpenSSL: Message - hexdump(len=2): 02 30

SSL: (where=0x4008 ret=0x230)

SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA

EAP: Status notification: local TLS alert (param=unknown CA)

SSL: (where=0x1002 ret=0xffffffff)

SSL: SSL_connect:error in error

OpenSSL: openssl_handshake - SSL_connect error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

One of your profiles contains the 2015 root of HARICA, the other a USERTrust CA certificate, so yes, once you renewed your certificates, things stopped working.  Your server serves the correct certificate, but your CAT profiles (which is what geteduroam uses) are outdated.

So, update both your eduroam CAT profiles on eduroam CAT with the 2021 version of the HARICA certificate, and tell your students to reconfigure their devices and everything will work again.

Kind regards

Stefan Paetow

Federated Roaming Technical Specialist

eduroam(UK), Jisc – 20 years of free Wi-Fi for the UK R&E sector

email/teams: address@concealed

gpg: 0x3FCE5142

For eduroam support, please contact the eduroam team via address@concealed and mark it for eduroam’s attention.

I am not available on Mondays and Fridays between 12:00 and 15:00 London time (UTC in winter, UTC+0100 in summer).

Note: I don’t expect a reply outside of your working hours, since I work internationally with colleagues in different nationalities with different religions, customs, and holidays. Reply when it is convenient for you.

Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

From: address@concealed <address@concealed> on behalf of Alessandro Carettoni <address@concealed>
Date: Tuesday, 22 September 2026 at 16:43
To: address@concealed <address@concealed>
Subject: [[cat-users]] Eduroam network configuration problems

 

Good evening, I am writing to report that since yesterday, students have been unable to configure the Eduroam network using the geteduroam application.

There have been no changes to the portal configuration on the IULM side, and we are unable to identify the source of the problem.

Could you please advise us on how to resolve this? Thank you, and have a good evening.

 

 

Alessandro Carettoni

 

 

To unsubscribe, send this message: mailto:address@concealed?subject=unsubscribe%20cat-users
Or use the following link: https://lists.geant.org/sympa/sigrequest/cat-users