Hi Jonathan,
Thanks for getting back to me.
Sounds like we might be having a similar issue as you’ve mentioned in your
original setup.
We did setup PF as a clean install though, so I don’t think we’re inheriting
any previous provisioning attempts.
With each new release, we find it cleaner to start from scratch with a new VM.
Without diving into debug apps on the Android, it ‘appears’ as though we’re
having a certificate trust issue.
Unfortunately we’re not seeing any prompt to accept it and have it trusted.
I have a feeling that purchasing a certificate might get around it, but can’t
see a way of integrating that approach with the PF PKI.
I would prefer to use the PF PKI and EAP if we could get the Android to trust.
We could forego the google store passthrough, as you’ve done, if we could get
this part to work.
Our only available testing device is a Samsung Galaxy S tablet running Android
4.4.2.
Would be really helpful to hear how you go with testing a Lollipop Android?
Thanks again for your help.
Cheers,
Dan
From: Jonathan Mahady [mailto:[email protected]]
Sent: Tuesday, 26 April 2016 9:44 AM
To: [email protected]
Subject: Re: [PacketFence-users] SSL server certificate for use with Android
Hey Daniel,
I just wanted to give you an update. I completely forgot the day off for anzac
day yesterday so I was unable to fire up the lab. However I did find my testing
notes. As i mentioned in my previous email. I couldn't get the android google
store (australia) bypass to work. I preinstalled the app and when PF asked me
to install the app I then clicked the installed app and it asked me for the
cert password and it then proceeded to install the settings. I did get a cert
warning as the CA cert wasn't trusted but I just accepted this on the test
phone and it was installed in the phones trusted certs with the device cert.
The wireless settings were also pushed successfully.
I did have a issue with my originally setup, specifically around the
provisioning were it just wouldn't work at all (like the issue your having) and
to resolve it I had to do a fresh install of packetfence and manually restore
the settings.
For onboarding, you will just a private self-signed CA cert for the onboarding
process, this must be accepted by the user as part of the onboarding process
and it typical for NAC solutions to use self-signed certs for EAP
authentications.
I won't be back in the office until Thursday but I'm curious to see if I have
any issues with a lollipop android device as I only tested with Jellybean. I'll
get back to you with my progress.
Cheers,
Jonathan
On 20 April 2016 at 10:52, Hack, Daniel (DPIPWE)
<[email protected]<mailto:[email protected]>> wrote:
Thanks Jonathan, that would be great!
I’ve tried your approach just now…
Connect to the open SSID, authenticate to the portal, launch the agent and
click configure.
I get prompted for the certificate password (PF PKI client certificate for
EAP), which is promising, but the agent gives ‘error: cannot create network’
I can only guess that’s due to the cert being untrusted on the Android’s
trusted root store.
If you get a chance to have a look at your test lab next week, that would be
great!
Thanks,
Dan
From: Jonathan Mahady
[mailto:[email protected]<mailto:[email protected]>]
Sent: Wednesday, 20 April 2016 11:18 AM
To:
[email protected]<mailto:[email protected]>
Subject: Re: [PacketFence-users] SSL server certificate for use with Android
Hey Daniel,
From memory I had to click the application once it got to that page. The
profile and certs were then pushed (you need to accept the cert error). With
any of the NAC solutions I've worked with the radius cert has always been apart
of clients domain CA and PKI infrastructure. The CA cert is then pushed to the
client which the user has to accept along with their newly created device cert.
I have a test lab in the office, let me fire up a packetfence instance and test
it again. I won't be in the office until Monday, I'll drop you an update then.
On 20 April 2016 at 08:12, Hack, Daniel (DPIPWE)
<[email protected]<mailto:[email protected]>> wrote:
Hi Jonathan,
Thanks for your reply.
We’ve had the same problem with getting the app downloaded to the Android via
passthrough.
If you have an Android with the app already installed, how are you getting the
wireless profile from the provisioner onto the device?
We’re seeing that even with the agent installed, when you ‘Click here to
install your generated wireless profile’, the browser still tries to go to the
Google app store URL?
Did you edit the template to pull the profile from the PF server somehow?
Thanks,
Dan
From: Jonathan Mahady
[mailto:[email protected]<mailto:[email protected]>]
Sent: Wednesday, 20 April 2016 9:04 AM
To:
[email protected]<mailto:[email protected]>
Subject: Re: [PacketFence-users] SSL server certificate for use with Android
Hi Daniel,
When I was testing android device I had no problem with any third party certs I
used. The only issue I had was around allow access to the google play store so
that users could download the app.I couldn't get the whitelisting for google
australia to work. In the end I just asked users to install the packetfence app
before onboarding.
Cheers,
Jonathan
On 19 April 2016 at 18:57, Louis Munro
<[email protected]<mailto:[email protected]>> wrote:
In a last ditch effort to try to get Android devices working with PacketFence,
we are looking at purchasing a server certificate from a trusted CA, that is
included in Android’s trusted root store.
Has anybody been down this path?
Any recommendations for certificate providers?
Hi Daniel,
Not sure if I missed your earlier messages to the list about this, but Android
usually works well on PacketFence.
Can you tell us a bit more about what exactly is not working and what leads you
to believe it's related to the certificates?
As for recommendations, a certificate is a certificate.
If it's been issued by a CA trusted by the device it should just work.
I have experience with InCommon, but that is not an exclusive endorsement.
Regards,
--
Louis Munro
[email protected]<mailto:[email protected]> ::
www.inverse.ca<http://www.inverse.ca>
+1.514.447.4918 x125<tel:%2B1.514.447.4918%20x125> :: +1 (866) 353-6153
x125<tel:%2B1%20%28866%29%C2%A0353-6153%20x125>
Inverse inc. :: Leaders behind SOGo (www.sogo.nu<http://www.sogo.nu>) and
PacketFence (www.packetfence.org<http://www.packetfence.org>)
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
PacketFence-users mailing list
[email protected]<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/packetfence-users
________________________________
CONFIDENTIALITY NOTICE AND DISCLAIMER
The information in this transmission may be confidential and/or protected by
legal professional privilege, and is intended only for the person or persons to
whom it is addressed. If you are not such a person, you are warned that any
disclosure, copying or dissemination of the information is unauthorised. If you
have received the transmission in error, please immediately contact this office
by telephone, fax or email, to inform us of the error and to enable
arrangements to be made for the destruction of the transmission, or its return
at our cost. No liability is accepted for any unauthorised use of the
information contained in this transmission.
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
PacketFence-users mailing list
[email protected]<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/packetfence-users
________________________________
CONFIDENTIALITY NOTICE AND DISCLAIMER
The information in this transmission may be confidential and/or protected by
legal professional privilege, and is intended only for the person or persons to
whom it is addressed. If you are not such a person, you are warned that any
disclosure, copying or dissemination of the information is unauthorised. If you
have received the transmission in error, please immediately contact this office
by telephone, fax or email, to inform us of the error and to enable
arrangements to be made for the destruction of the transmission, or its return
at our cost. No liability is accepted for any unauthorised use of the
information contained in this transmission.
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
PacketFence-users mailing list
[email protected]<mailto:[email protected]>
https://lists.sourceforge.net/lists/listinfo/packetfence-users
________________________________
CONFIDENTIALITY NOTICE AND DISCLAIMER
The information in this transmission may be confidential and/or protected by
legal professional privilege, and is intended only for the person or persons to
whom it is addressed. If you are not such a person, you are warned that any
disclosure, copying or dissemination of the information is unauthorised. If you
have received the transmission in error, please immediately contact this office
by telephone, fax or email, to inform us of the error and to enable
arrangements to be made for the destruction of the transmission, or its return
at our cost. No liability is accepted for any unauthorised use of the
information contained in this transmission.
------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
PacketFence-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/packetfence-users
