EAP TLS against multiple certificates?

[David Hartburn]

Hi,

The clients had SHA1 certs and the FreeRADIUS server has a SHA1 chain.

Clients have just started to upgrade to SHA256 certificates which fail 
when authing against the SHA1 chain on the server.

I have generated on our dev server a SHA256 chain, which will allow 
those clients which have updated to authenticate, but it will lock out 
those which still have SHA1.

If it is possible to use both types of chain, how do I go about that? It 
does not look like you can have two ca_file entries in the eap 
tls-config section. Is it possible to cat the two server files into a 
single file pointed to by ca_file and have it work that way?

David


On 03/05/17 15:14, Alan DeKok wrote:
> On May 3, 2017, at 9:36 AM, David Hartburn <D.J.Hartburn at kent.ac.uk> wrote:
>> I remove the comments from the config snipped I posted to make it more readable for the list, but they do exist in my original configuration.
>>
>> 		#  In general, you should use self-signed
>> 		#  certificates for 802.1x (EAP) authentication.
>> 		#  In that case, this CA file should contain
>> 		#  *one* CA certificate.
>>
>> To me this suggests it is not possible to have more than one certificate. Is this correct?
>
>   No.  It suggests that in some cases you want to use one CA cert.  In other cases, you can use multiple CA certs.
>
>> If so, any suggestions on how we can solve this issue or is it a case of finding every SHA1 client and forcing them to update their cert?
>
>   What cert is where?  Do you mean the clients are using certs with SHA1?  Or the CA cert?  Please be specific.
>
>   And either way, the only way to upgrade the client (client cert or CA cert) is to put the new certs onto the client.
>
>> The ideal solution would be to be able to support a SHA1 chain and a SHA256 chain as a migratory step, dropping the SHA1 in the near future. The only other option was to have a 'change day' when both the servers and clients all changed. It looks like that change day may have unexpectedly become today!
>
>   You can use multiple CA certs.
>
>   Alan DeKok.
>
>
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>