Dont do 802.1x without a provisioner that creates a profile on the device telling the device to trust connections secured with a cert issued by a particular root CA with a particular common name. Otherwise, someone could setup an AP at the side of the road around the corner from your campus and peoples phones will authenticate to it and pass off credentials as they are driving by. :D
SecureW2 works great for us. I honestly haven't tried any of the PF provisioners yet because they came out after we purchased SecureW2. Windows will NOT work at ALL with a wildcard cert. So maybe that is your issue right there. On Tue, Apr 5, 2016 at 6:23 AM, Nathan, Josh <[email protected]> wrote: > Well, I'm OK with doing private, but here's my dilemma. We're trying to > do a BYOD model, but we'd still like to use 802.1X for our wireless. Right > now, iOS, OSX, and Android will connect, but Windows refuses. I think it's > because of the SSL certificates. The other 3 OSs complain mildly, but they > allow me to trust the cert, and then don't have any problems. Windows just > won't connect. Since we're wanting to do BYOD, I can't readily install a > client cert on every Windows device that walks through our door. Any > suggestions? I'm not really getting any definitive errors, only the > generic "Can't connect" from Windows, but I've read online in various spots > that this seems to be a cert issue. > > Thanks, > Joshua Nathan > Level 3 IT Support and Development > Black Forest Academy > +49 (0) 7626-9161-630 > > > On Tue, Apr 5, 2016 at 12:15 PM, Tim DeNike <[email protected]> wrote: > >> And I'll be completely honest which you. We're getting ready to dump >> usin a public CA for 802.1x. Comodo in particular has been a pain. >> Androids don't always have a complete certificate chain for comodo, and >> Windows Pcs seem to randomly get an intermediate cert set in third party >> store as a trusted root (I'm pretty sure it's a few installers/apps doing >> it). So between the 2 problems, you can make all of one or all of the >> other work with no problems but you'll always have to screw with the >> other. Private CA is the way to go imho. >> >> Sent from my iPhone >> >> On Apr 5, 2016, at 6:05 AM, Nathan, Josh <[email protected]> >> wrote: >> >> Hello, >> >> So I'm trying to get Radius to supply a valid cert. Even though I've got >> my PacketFence server, itself, using my Comodo Wildcard certificate, I can >> see when logging into my wireless AP via 802.1X that I'm still getting the >> self-signed Radius cert. I renamed the certs directory according to the >> README file located in it, and then I created a symbolic link to my PF ssl >> directory. I then did a packetfence-config restart and a packetfence >> restart, but my iPad still shows that I'm getting the self-signed test >> Radius cert. >> >> What documentation did I miss? >> >> Thanks, >> Joshua Nathan >> Level 3 IT Support and Development >> Black Forest Academy >> +49 (0) 7626-9161-630 >> >> >> ------------------------------------------------------------------------------ >> >> _______________________________________________ >> PacketFence-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/packetfence-users >> >> >> >> ------------------------------------------------------------------------------ >> >> _______________________________________________ >> PacketFence-users mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/packetfence-users >> >> > > > ------------------------------------------------------------------------------ > > _______________________________________________ > PacketFence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users > >
------------------------------------------------------------------------------
_______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
