On Mar 25, 2019, at 5:06 AM, Jim Potter <j.potter@bathspa.ac.uk> wrote:
So doesn't the client return a PEAP request containing the MSCHAPv2 request encrypted using the server certificate?
No. PEAP essentially sets up a TLS connection between the two endpoints. It then sends MS-CHAPv2 data inside of the TLS tunnel. The MS-CHAPv2 is protected via the TLS protocol. It is *not* "encrypted using the server certificate".
My hope was that if a client device wasn't using a cert at all,
The client device gets the server cert sent to it by the server, as part of the TLS exchange. The client device is free to *ignore* this server certificate.
I could see the format of the reply or something similar... but then if the clients are using whatever cert is sent out, but not validating it, that wouldn't show up.
Yes.
OK, so, plan B - if I set up a rogue access point (FreeRadius WPE or similar with a self signed certificate), I could see who connects regardless of the dubious cert, then chase them up. Would that work?
People will connect if they configure it manually. Which most won't. There really isn't any point in doing this. You won't get any useful information from it. Alan DeKok.