Thanks for those links Stefan. We do have both eduroam and our own internal auth. Cheers, - Trevor On Thu, Jun 15, 2017 at 1:52 AM, Stefan Winter <stefan.winter@restena.lu> wrote:
Hi,
You will receive the prompt the first time a new device connects to that SSID. You should really pre-configure the clients or you’re putting the user’s credentials at risk.
Exactly. For a longer treatise on the subject:
https://wiki.geant.org/display/H2eduroam/EAP+Server+ Certificate+considerations
(applicability not limited to eduroam)
If the OP is doing this for an eduroam installation, said pre-configuration profiles can be built at
If this is not about eduroam, there are plenty of commercial solutions. A freemium one is
Greetings,
Stefan Winter
On 6/14/17, 11:39 AM, "Freeradius-Users on behalf of Alan DeKok"
<freeradius-users-bounces+timc=hpe.com@lists.freeradius.org on behalf of aland@deployingradius.com> wrote:
On Jun 14, 2017, at 11:19 AM, Trevor Jennings <Trevor@simple101.com>
wrote:
> > We are using Thawte which Apple devices already trust (These are
more
> common devices on our network).
Do not use public CA certs for WiFi authentication. It's insecure.
And no, the Apple devices do NOT already trust the Thawte cert for
WiFi authentication. They trust the Thawte cert for web surfing, which is entirely different.
You need to have a mobileconfig which tells each device what the
SSID is, what EAP method to use, and what CA to use.
> Are you referring to configuration profiles that are setup on the
clients?
Yes. You need to configure each device as I said above.
In order to get EAP working, follow the guide at:
http://deployingradius.com/documents/configuration/eap.html
It WILL work.
And yes, it involves creating your own certificates, and also
installing the certificates on the clients.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/
list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/
list/users.html
-- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette
Tel: +352 424409 1 Fax: +352 422473
PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html