An open discussion list for topics related to the geteduroam service

[Darren Boss <Darren.Boss AT alliancecan.ca>]

After I created a new server cert with the following command
bin/server-sign.php alliancecan.ca radius.alliancecan.ca
it's working now from MacOS and my Pixel6 running the beta version of 
geteduroam. I was able to test under Android 12 and 13 as I was able to 
upgrade today. My co-worker said his older Pixel 4 was not able to connect. 
Older iPad was dusted off and worked as well. It sounds like if I create the 
CA correctly (SAN gets set correctly) and import that in I should be good? 

I think I'm close to having a usable setup at this point. Thanks for the 
suggestions and explanations.

Does anyone have any tips of getting more information from clients like 
Android and IOS devices when there are problems? The MacOS logs told us 
exactly what was wrong when connecting.

From: Jørn Åne de Jong <jornane.dejong AT surf.nl>
Sent: Monday, August 22, 2022 4:23 PM
To: Darren Boss <Darren.Boss AT alliancecan.ca>; Chris Phillips 
<Chris.Phillips AT canarie.ca>; Paul Dekkers <paul.dekkers AT surf.nl>; 
geteduroam AT lists.geant.org <geteduroam AT lists.geant.org>; Jørn Åne de Jong 
<jornane.dejong AT surf.nl>
Subject: Re: Problem with certificates generated 
 
On 22/08/2022 21:06, Darren Boss wrote:
> Getting to the heart of the issue now. My co-worker saw this message in his 
> MacOS logs while connecting:
> SecTrustEvaluateWithError failed, Error Domain=NSOSStatusErrorDomain 
> Code=-67602 ""alliancecan.ca" certificate name does not match input" 
> UserInfo={NSLocalizedDescription="alliancecan.ca" certificate name does not 
> match input, NSUnderlyingError=0x7fd1f95053e0 {Error 
> Domain=NSOSStatusErrorDomain Code=-67602 "Certificate 0 "alliancecan.ca" 
> has errors: Trusted EAP hostname does not match name(s) in certificate;" 
> UserInfo={NSLocalizedDescription=Certificate 0 "alliancecan.ca" has errors: 
> Trusted EAP hostname does not match name(s) in certificate;}}}
> 
> I'm not creating the server certificate correctly is how I read this. I'm 
> confused about how I would determine what the Trusted EAP hostname would 
> even be.
> 
[…]
> 
> I also corrected this:
> bin/server-sign.php alliancecan.ca days_valid=1095
> which puts days_valid in the subject. I've created my server cert using and 
> replaced them on the radius server:
> bin/server-sign.php alliancecan.ca radius.alliancecan.ca

I see two possible problems here:

1) Since about a year, Apple prohibits certificate lifetimes [1].
Publicly trusted certificates must now be valid for 398 days or less, 
and privately trusted certificates (such as with your own RADIUS server) 
must be valid for 825 days or less.
In the link I sent, it's unclear whether the 825 days limit is enforced, 
but from testing I can confirm that it is.  I will update the 
documentation and default values in the project as well.

2) I noticed that, when using the built-in CA, no sAN is set for the CA 
or the certificates.  The current Android app might have an issue with 
that, but it should work on the other platforms.  Recommend using a 
public certificate, or wait until I've patched this (may take a week or 
two).

[1] https://discussions.apple.com/thread/251323073