An open discussion list for topics related to the geteduroam service

[Jørn Åne de Jong <jornane.dejong AT surf.nl>]

On 22/08/2022 21:06, Darren Boss wrote:
> Getting to the heart of the issue now. My co-worker saw this message in his 
> MacOS logs while connecting:
> SecTrustEvaluateWithError failed, Error Domain=NSOSStatusErrorDomain Code=-67602 ""alliancecan.ca" certificate name does 
> not match input" UserInfo={NSLocalizedDescription="alliancecan.ca" certificate name does not match input, 
> NSUnderlyingError=0x7fd1f95053e0 {Error Domain=NSOSStatusErrorDomain Code=-67602 "Certificate 0 "alliancecan.ca" has 
> errors: Trusted EAP hostname does not match name(s) in certificate;" UserInfo={NSLocalizedDescription=Certificate 0 
> "alliancecan.ca" has errors: Trusted EAP hostname does not match name(s) in certificate;}}}
>
> I'm not creating the server certificate correctly is how I read this. I'm 
> confused about how I would determine what the Trusted EAP hostname would even 
> be.
[…]
> I also corrected this:
> bin/server-sign.php alliancecan.ca days_valid=1095
> which puts days_valid in the subject. I've created my server cert using and 
> replaced them on the radius server:
> bin/server-sign.php alliancecan.ca radius.alliancecan.ca

I see two possible problems here:

1) Since about a year, Apple prohibits certificate lifetimes [1].
Publicly trusted certificates must now be valid for 398 days or less, 
and privately trusted certificates (such as with your own RADIUS server) 
must be valid for 825 days or less.
In the link I sent, it's unclear whether the 825 days limit is enforced, 
but from testing I can confirm that it is.  I will update the 
documentation and default values in the project as well.

2) I noticed that, when using the built-in CA, no sAN is set for the CA 
or the certificates.  The current Android app might have an issue with 
that, but it should work on the other platforms.  Recommend using a 
public certificate, or wait until I've patched this (may take a week or 
two).

[1] https://discussions.apple.com/thread/251323073