more on server certificates

[Phil Mayers]

Ben Thompson wrote:
> Hi
> 
> Has anybody got a digital certificate (with the extended key usage
> attributes required for PEAP) installed on their FreeRADIUS box that has
> been signed by a commercial trusted CA? 
> 
> I have come to suspect that this is impossible due to the fact that
> Verisign are the only company marketing such a product and it can only
> be installed on a Windows server (as the online purchase system only
> works if done from the target machine using Internet Explorer and
> Xenroll).

Not really a freeradius issue, but you could maybe enable the various 
certificate store export options before doing the purchase, then export 
it. You'd need to (re)name the box you purchased from appropriately, but 
only for the duration of the purchase.

Though I can understand you wanting a pre-trusted cert, we didn't find 
it particularly onerous to distribute a self-signed one.

I am surprised no-one else is offering that EKU oid. Have you tried 
speaking to someone technically knowledgeable at one of the other CAs - 
it may be something they can do as a specific request, even if it's not 
a default option.