Hal Pomeranz <hal@deer-run.com> wrote:
I will note however that if I try to set:
check_cert_cn = %{User-Name}
in the "tls" section of eap.conf, then I am unable to connect to the network with EAP/TLS.
See debug mode for why.
I don't fully understand from the docs what this parameter is doing exactly. Is this supposed to work? Is there some configuration (perhaps in my users file) that I'm missing? What is the impact of NOT setting this parameter?
The issue is that the User-Name attribute may be different than the CN in the certificate. i.e. I steal your certificate and use it. This check tries to ensure that the person using the certificate is the one who's supposed to be using it. The impact of not setting it is usually minor. Alan DeKok.