2013/9/12 Brian Julin <BJulin@clarku.edu>
Trevor Jennings wrote:
[...]
On OSX, the certificates are marked as valid, including the root, intermediate and server, but still prompts the user to accept. Is there a way around this?
About the only way I can think of is to install a profile (.mobileconfig) which pre-approves the use of that certificate authority.
If you want to make things all nice and green-looking for your end-users seek for mobileconfig signing. TERENA has a good example how to do this for eduroam: https://confluence.terena.org/display/tcs/Sign+Apple+mobileconfig+files Reason being, if you just
accept any old certificate authority any compromised certificate will work, and on newer OSX/iOS the only way to check the certificate subject for the name of your RADIUS server.
And as you mention OS X, yes the same .mobileconfig for iOS will work for OS X 10.7 onwards, which was a quite nice thing in my environment to know.
[...]
(Incidentally this is why many environments do not like having Android
devices on their wireless LANs since they don't have any such native options accessible from the UI or even a decent way to distribute profiles.
At least from that side there is hope for improvements with Android 4.3 onwards there are API calls for enterprise wireless configuration. Maybe "someone" steps up by making an application that can manage profiles or something like this. Heck they don't even fake it by making the first certificate they see
sticky.
Worse... ;-) It's up to the user to install the CA certificate on its own - even if that is a public CA in the Android, they can't select them otherwise (!) . At least then authentication stops if you put up a server certificate not signed by that specified CA. The only open source provisioning tool for Android (that I believe didn't get much traction) SU1X for Android, made by Swansea University for eduroam. -- Mathieu