The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Lukas Wringer <address@concealed>]

Hi,

... us for example the University of Augsburg ( not to confuse with
Augsburg University this is someone else ;-) )

We use geteduroam/let's wifi with EPA-TLS as well as our own local CA,
and a sub-ca (intermediate) issuing the certificates for the RADIUS.

As I said - while it is true that geteduroam uses ca-cert instead of
ca-path when run with newer versions of NM that does not help when you
have an intermediate and you want to supply the whole chain as
wpa_supplicant 2.11 does not work with single file chains (or multiple
CAs for that matter...). 

To use a single file chain you would need 2.12 of wpa_supplicant which
is not the supplied Version in 26.04.1

This Problem is not limited to Ubuntu either allthough we mostly got
reports from rolling distros... 

https://github.com/geteduroam/linux-app/issues/101#issuecomment-5830814383

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/work_items/1886#note_3680937

Greetings,

Lukas

Am Donnerstag, dem 29.10.2026 um 23:45 +0100 schrieb Tomasz Wolniewicz:
> Current CAT installers (as well as geteduroam) are supposed to
> recognise 
> the Network Manager versions and act accordingly. My tests with
> Ubuntu 
> 26 showed that this worked fine.
> 
> Can you point to the organisation you are haveing problem with, I
> will 
> try to test this on my installation.
> 
> Yours
> 
> Tomasz Wolniewicz
> 
> 
> W dniu 29.10.2026 o 23:42, Lukas Wringer (via cat-users Mailing List)
> pisze:
> > Hi,
> > 
> > there is currently a rather schizofrenic problem where the
> > NetworkManager does no longer allow "ca-path" pointing to a
> > directory
> > as a way to configure the certificate (chain) for a user specific
> > (aka
> > private) connection but the wpa_supplicant not yet can understand a
> > single .pem file to contain all chain elements.
> > 
> > Not 100% sure how the install script handles that but propably the
> > same
> > as 'geteduroam' - see the corresponding issue(s) over by the
> > geteduroam
> > project:
> > 
> > https://github.com/geteduroam/linux-app/issues/97
> > 
> > https://github.com/geteduroam/linux-app/issues/101
> > 
> > If your certificate has no intermediate you are lucky - as this
> > works
> > fine. If not you may need to work around it by setting the
> > connection
> > to global / systemwide with all the caveats that this implies or if
> > you
> > are using a well known CA point to the systems ca store istead of
> > pinning a single ca...
> > 
> > Greetings, Lukas
> > 
> -- 
> Tomasz Wolniewicz

-- 
Lukas Wringer

Universität Augsburg
Rechenzentrum
Service & Support
86135 Augsburg

Besucheradresse und Servicezeiten:
Universitätsstraße 8
Gebäude L2, Raum 2034
Montag bis Donnerstag von 9.00 bis 14.30 Uhr
Freitag von 9.00 bis 12.00 Uhr

Telefax 0821/598-2010
address@concealed
https://www.rz.uni-augsburg.de

Attachment: signature.asc
Description: This is a digitally signed message part