The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Tomasz Wolniewicz <address@concealed>]

It is semi-supported. If you click "Installer fine tuning and download" 
and you have TLS set in your profile then you will be able to set 
EAP-specific options for TLS. One of the is "Turn on EAP-TLS UserName". 
If you turn this on the Windows installer will ask the user to provide 
the username.

I realise that this is not exactly what you are looking for and I am not 
sure how this would work on other systems. Definitely CAT Linux 
installers would also ask, o Apple propably the system will ask as well.

However there is probably a much better solution. Create TLS 
certificates for users with CN=anonymous@realm  and put the real 
username as the mail attribute in the certificate. You also need to 
setup your RADIUS server to act on email for user verification. With 
this it will univerally work across all platforms without any additional 
settings on client side. The CN is used as the RADIUS UserName.

Tomasz


W dniu 2.10.2026 o 08:56, Jan-Frederik Rieckers (via cat-users Mailing 
List) pisze:
> Hi all,
>
> one of our institutions wants to use a specific "outer" ID for EAP-TLS.
> (Technical background: The server root certificate expires and they 
> want to migrate to a new root using a switch by outer ID)
>
> They use their own certificates, but want to use CAT for configuring 
> the devices. On Windows they noticed that the installer does not honor 
> the outer ID configuration, apparently the Windows installer doesn't 
> even include this.
>
> From what I heard from the admin, windows needs a specific 
> "DifferentUsername" property to not use the CN/UPN/... from the 
> certificate.
>
> Does the windows installer support it already and we're just holding 
> it wrong?
> If not: Is this something that the windows installer could be doing?
>
> Cheers,
> Janfred
--
Tomasz Wolniewicz

Attachment: smime.p7s
Description: Kryptograficzna sygnatura S/MIME