I agree with everything Tim wrote. As for the wrong certificate being sent, make sure your /usr/local/conf/radiusd/eap.conf file points to the right certificate file. That file is a template that gets filled in and generates the raddb/eap.conf file which FreeRADIUS uses to configure PEAP et al. The file is regenerated everytime you restart PacketFence or run a bin/pfcmd service radiusd restart.
Regards, -- Louis Munro [email protected] :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org) > On Apr 5, 2016, at 6:34 , Tim DeNike <[email protected]> wrote: > > Dont do 802.1x without a provisioner that creates a profile on the device > telling the device to trust connections secured with a cert issued by a > particular root CA with a particular common name. Otherwise, someone could > setup an AP at the side of the road around the corner from your campus and > peoples phones will authenticate to it and pass off credentials as they are > driving by. :D > > SecureW2 works great for us. I honestly haven't tried any of the PF > provisioners yet because they came out after we purchased SecureW2. > > Windows will NOT work at ALL with a wildcard cert. So maybe that is your > issue right there. > > On Tue, Apr 5, 2016 at 6:23 AM, Nathan, Josh <[email protected] > <mailto:[email protected]>> wrote: > Well, I'm OK with doing private, but here's my dilemma. We're trying to do a > BYOD model, but we'd still like to use 802.1X for our wireless. Right now, > iOS, OSX, and Android will connect, but Windows refuses. I think it's > because of the SSL certificates. The other 3 OSs complain mildly, but they > allow me to trust the cert, and then don't have any problems. Windows just > won't connect. Since we're wanting to do BYOD, I can't readily install a > client cert on every Windows device that walks through our door. Any > suggestions? I'm not really getting any definitive errors, only the generic > "Can't connect" from Windows, but I've read online in various spots that this > seems to be a cert issue. > > Thanks, > Joshua Nathan > Level 3 IT Support and Development > Black Forest Academy > +49 (0) 7626-9161-630 <tel:%2B49%20%280%29%207626-9161-630> > > > On Tue, Apr 5, 2016 at 12:15 PM, Tim DeNike <[email protected] > <mailto:[email protected]>> wrote: > And I'll be completely honest which you. We're getting ready to dump usin a > public CA for 802.1x. Comodo in particular has been a pain. Androids don't > always have a complete certificate chain for comodo, and Windows Pcs seem to > randomly get an intermediate cert set in third party store as a trusted root > (I'm pretty sure it's a few installers/apps doing it). So between the 2 > problems, you can make all of one or all of the other work with no problems > but you'll always have to screw with the other. Private CA is the way to go > imho. > > Sent from my iPhone > > On Apr 5, 2016, at 6:05 AM, Nathan, Josh <[email protected] > <mailto:[email protected]>> wrote: > >> Hello, >> >> So I'm trying to get Radius to supply a valid cert. Even though I've got my >> PacketFence server, itself, using my Comodo Wildcard certificate, I can see >> when logging into my wireless AP via 802.1X that I'm still getting the >> self-signed Radius cert. I renamed the certs directory according to the >> README file located in it, and then I created a symbolic link to my PF ssl >> directory. I then did a packetfence-config restart and a packetfence >> restart, but my iPad still shows that I'm getting the self-signed test >> Radius cert. >> >> What documentation did I miss? >> >> Thanks, >> Joshua Nathan >> Level 3 IT Support and Development >> Black Forest Academy >> +49 (0) 7626-9161-630 <tel:%2B49%20%280%29%207626-9161-630> >> >> ------------------------------------------------------------------------------ >> _______________________________________________ >> PacketFence-users mailing list >> [email protected] >> <mailto:[email protected]> >> https://lists.sourceforge.net/lists/listinfo/packetfence-users >> <https://lists.sourceforge.net/lists/listinfo/packetfence-users> > > ------------------------------------------------------------------------------ > > _______________________________________________ > PacketFence-users mailing list > [email protected] > <mailto:[email protected]> > https://lists.sourceforge.net/lists/listinfo/packetfence-users > <https://lists.sourceforge.net/lists/listinfo/packetfence-users> > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > PacketFence-users mailing list > [email protected] > <mailto:[email protected]> > https://lists.sourceforge.net/lists/listinfo/packetfence-users > <https://lists.sourceforge.net/lists/listinfo/packetfence-users> > > > ------------------------------------------------------------------------------ > _______________________________________________ > PacketFence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users
------------------------------------------------------------------------------
_______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
