Certificates issue in android terminals (EAP-TLS)
Hello. This problem is not specifically of freeradius but maybe someone can help me. After a painful process I finally got my Freeradius 2.2.8 server to run with only EAP-TLS authentication (my experience with freeradius is still short). But I've found a problem: when I install ca and user certificates in an antroid terminal all goes well first time i connect, but if I restart the device, or even if I switch from a wifi conection to another, or i set "forget" the conection, my device loses the certificates, so i have to install it again in order to access the network, it happens me with various devices of different models and brands, after i google it a little i've found some people with the same problem, but no solution. Could anyone help me with this issue? What is causing this behaviour? Has anyone a succesfull experience with eap-tls and android devices? Any help will be appretiated. Thanks in advance.
On Mar 23, 2017, at 4:49 PM, Daniel Lopez <danilogo1991@gmail.com> wrote:
This problem is not specifically of freeradius but maybe someone can help me. After a painful process I finally got my Freeradius 2.2.8 server to run with only EAP-TLS authentication (my experience with freeradius is still short).
If it's painful, ask for help. And version 3 is a lot easier to configure for EAP-TLS.
But I've found a problem: when I install ca and user certificates in an antroid terminal all goes well first time i connect, but if I restart the device, or even if I switch from a wifi conection to another, or i set "forget" the conection, my device loses the certificates, so i have to install it again in order to access the network, it happens me with various devices of different models and brands, after i google it a little i've found some people with the same problem, but no solution. Could anyone help me with this issue? What is causing this behaviour? Has anyone a succesfull experience with eap-tls and android devices? Any help will be appretiated. Thanks in advance.
My guess is that the certificates are installed in the terminal session... not in the device WiFi configuration. Use a standard way of installing the certificates, and it should work. See http://802.1x-config.org, that may help. Alan DeKok.
*Thanks for you response* *>" If it's painful, ask for help. And version 3 is a lot easier to configure for EAP-TLS."* Thanks for the advice, I haven't found binaries for Ubuntu 16.04 but I'll consider test it from source code. *>"My guess is that the certificates are installed in the terminal session... not in the device WiFi configuration.* * Use a standard way of installing the certificates, and it should work. See http://802.1x-config.org <http://802.1x-config.org/>, that may help."* I tried both ways ( Settings -> Security -> Credential Storage ->“Install from storage” and Settings -> Wifi -> advanced -> Install Certificates) I think it is the standard way. in http://802.1x-config.org*, *Doesn't seem to be a solution for android but for others platforms instead. It seems to be serious issues with android and self-signed certificates. 2017-03-23 19:00 GMT-04:00 Alan DeKok <aland@deployingradius.com>:
On Mar 23, 2017, at 4:49 PM, Daniel Lopez <danilogo1991@gmail.com> wrote:
This problem is not specifically of freeradius but maybe someone can help me. After a painful process I finally got my Freeradius 2.2.8 server to run with only EAP-TLS authentication (my experience with freeradius is still short).
If it's painful, ask for help. And version 3 is a lot easier to configure for EAP-TLS.
But I've found a problem: when I install ca and user certificates in an antroid terminal all goes well first time i connect, but if I restart the device, or even if I switch from a wifi conection to another, or i set "forget" the conection, my device loses the certificates, so i have to install it again in order to access the network, it happens me with various devices of different models and brands, after i google it a little i've found some people with the same problem, but no solution. Could anyone help me with this issue? What is causing this behaviour? Has anyone a succesfull experience with eap-tls and android devices? Any help will be appretiated. Thanks in advance.
My guess is that the certificates are installed in the terminal session... not in the device WiFi configuration.
Use a standard way of installing the certificates, and it should work. See http://802.1x-config.org, that may help.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On 24/03/2017 14:53, Daniel Lopez wrote:
Thanks for the advice, I haven't found binaries for Ubuntu 16.04 but I'll consider test it from source code.
Google "ubuntu freeradius repository", first hit is: https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0 (not yet updated to 3.0.13 though)
Thanks Brian. I tried with those repos but it returns me dependences security errors when i try to installi the package, maybe it's somthing i'm doing wrong. Before long i'll try it again, but right now my freeradius server works well with EAP-TLS. My problem is with certificates in android devices as I mentioned before. Maybe you or someone have had a similar situation and can share experiences. Regards 2017-03-24 11:03 GMT-04:00 Brian Candler <b.candler@pobox.com>:
On 24/03/2017 14:53, Daniel Lopez wrote:
Thanks for the advice, I haven't found binaries for Ubuntu 16.04 but I'll consider test it from source code.
Google "ubuntu freeradius repository", first hit is:
https://launchpad.net/~freeradius/+archive/ubuntu/stable-3.0
(not yet updated to 3.0.13 though)
On Fri, Mar 24, 2017 at 11:39:20AM -0400, Daniel Lopez wrote:
I tried with those repos but it returns me dependences security errors when i try to installi the package, maybe it's somthing i'm doing wrong.
The instructions on the wiki should work http://wiki.freeradius.org/building/Debian%20and%20Ubuntu Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
participants (4)
-
Alan DeKok -
Brian Candler -
Daniel Lopez -
Matthew Newton