On 09/01/12 17:42, Mike Diggins wrote:
I use a Thawte Premium Server CA for my WPA2 Enterprise freeradius authentication certificate currently. My eap.conf 'certificate file' contains the certificate only, not the root and/or intermediates. That seems to be ok, since most clients already have the Thawte Root certificate installed.
I renewed the new certificate just recently and discovered that Thawte is no longer issuing certificates under the old root so my clients will likely be asked to trust the new certificate when I install it. All my documentation changes as well but that's another story.
My question is, what is the value of adding the roots/intermediates to the certificate file i.e certificate_file = ${certdir}/certificate.crt? Does it really allow a client without the Root already installed to verify this certificate?
Most clients: 1. Have all the common "top-level" CAs installed 2. May or may not have the intermediate CAs We put the server & intermediate certs (NOT the top-level) into the cert file, and in our experience this lets all clients (Windows, MacOS, iOS, Android) connect without errors. I believe that, if the client really does lack the top-level CA, you're screwed. You will have to manually install at least the top-level cert, except on MacOS (and possibly iOS, but not sure).