Alternate server certificate

[Ivan Kalik]

> Don't both solutions have the same risk (my first idea was to use a 2nd
> eap instance with the public CA)?  I understand the risk; but, in this
> case, it's a tradeoff between presenting a cert signed by a public CA
> (makes it easier for these outside users to configure our wireless), have
> all guest users not validate the server cert (even worse) or distribute
> our internal CA's cert to every guest user (not logistically practical).

So, why do you bother authenticating users on guest SSID at all? Just
leave it open. Even if there is a registration form or such stuff where
user will be giving sensitive information that should be protected by SSL
on the web server anyway - no need to encrypt on wireless side as well.

And the fact that someone can snoop and find out which information pages
are your guests reading shouldn't really be of any practical concern.

Ivan Kalik
Kalik Informatika ISP