EAP-TLS and IOS 13

[Gregory Sloop]

[Replying direct, so as not to clutter the list/thread.]

Ted - I'm probably hours to a day or two from trying to setup the same on a fleet of iPads.

Given the back-and-forth, I'm not at all clear what the "solution" is.
I'd be eternally grateful if you'd post a summary of the issues, especially once you fix them, to the list. :)

It doesn't sound like we really understand all the issues with certs 
[2 years lifetime limit, really? - My certs generally have 10y lifetimes! I don't want to push new certs to all the ipads in two years!] - but again, as it becomes clear, it would be a super big help to me. [I'm certainly fluent on istuff - but it's often weird and hard to figure out how to make it work on both Windows and iOS/MacOS - at least without generating certs/keys in formats specially for Apple stuff. [p12's for example]

[I use GNUTLS for CA/cert/key generation - so I'll have to find a way to do it there, or use openssl - we'll see.]

Anyway - Thanks in advance!

-Greg

THR> I love *pple. And by love I mean exactly the opposite.....Regardless, my
THR> many thanks to all that assisted with my tribulations and blatherings 
THR> regarding getting ipads and Win10 machines working with an EAP-TLS 
THR> environment. As of this morning I had everything migrated, wiped, 
THR> re-tested, full bare-metal automation tested and ready to deploy to the
THR> minions. I had a very happy moment.

THR> Until someone walked in with an ipad that they just upgraded to IOS 13.

THR> tl/dr: IOS13 introduces more stringent compliance for certificates 
THR> (https://support.apple.com/en-us/HT210176) and that means certificates
THR> that used to work for EAP, now do not install - well that's not true. 
THR> They install, they say they're verified, but the ipad does not recognize
THR> them as useful, and ONLY presents a TTLS-like connection interface 
THR> (username and password, instead of certificate and identity). They 
THR> simply sit there all happy and useless. (BTW, manual cert install is now
THR> an 8 page document in my library, including download, allow,accept, 
THR> enable Cert Trust Settings, install, validate and....then watch do 
THR> nothing.) Since the ipad does not present a tls transaction, FR3 doesn't
THR> participate. I am not using EAP-TTLS, so that module does exactly what
THR> is it supposed to do - find no verified username and reject.

THR> I've used my google-fu to get the basic idea of modifying the openssl 
THR> commands to include the EKU, and sha2, but some of the other 
THR> requirements I'm not sure about implementing. The "no longer than 2 
THR> years" is also a PITA. Either way, has anyone worked out a magic bullet
THR> for this yet? Amazingly, M$ is no longer on my hated list - the Win10 
THR> machines are now in the "it simply works" category! Longing to learn 
THR> from the masters, yet again!

THR> Thanks,

THR> Ted.