Alternate server certificate

[Ivan Kalik]

> We have Access Points that contain multiple SSIDs.  Some are for internal
> use and some are for guest access.  All are secured using WPA w/PEAP.  I
> would like FreeRadius to present a cert. from our internal CA for the
> SSIDs that are internal and present a cert. from one of the CA's that
> Windows trusts by default for guest access.  I haven't found a way to
> control this on the AP (i.e., to select a different RADIUS server address
> or port based upon SSID).  Is it possible to accomplish this in FreeRadius
> given that I can determine the SSID by looking at a request attribute?

Yes.

>
> Some ideas I have are:
>
> - Have two instances of the EAP module (one for internal SSIDs and one for
> guest) and select which one to use with some unlang code (based upon the
> value of 1 request attribute)

That should work.

> - Create a virtual server for guest access that uses an EAP module with
> the cert. from the well-known CA

That is insecure. Your clients will trust *any* server certificate signed
by that public CA.

Ivan Kalik
Kalik Informatika ISP