WPA Enterprise Certificate renewal for FreeRadius

2012-01-09 Thread Mike Diggins
I use a Thawte Premium Server CA for my WPA2 Enterprise freeradius authentication certificate currently. My eap.conf 'certificate file' contains the certificate only, not the root and/or intermediates. That seems to be ok, since most clients already have the Thawte Root certificate

Re: WPA Enterprise Certificate renewal for FreeRadius

2012-01-09 Thread Sven Hartge
Mike Diggins mike.digg...@mcmaster.ca wrote: I use a Thawte Premium Server CA for my WPA2 Enterprise freeradius authentication certificate currently. My eap.conf 'certificate file' contains the certificate only, not the root and/or intermediates. That seems to be ok, since most clients

Re: WPA Enterprise Certificate renewal for FreeRadius

2012-01-09 Thread Phil Mayers
On 09/01/12 17:42, Mike Diggins wrote: I use a Thawte Premium Server CA for my WPA2 Enterprise freeradius authentication certificate currently. My eap.conf 'certificate file' contains the certificate only, not the root and/or intermediates. That seems to be ok, since most clients already have

Re: WPA Enterprise Certificate renewal for FreeRadius

2012-01-09 Thread Mike Diggins
On Mon, 9 Jan 2012, Phil Mayers wrote: On 09/01/12 17:42, Mike Diggins wrote: I use a Thawte Premium Server CA for my WPA2 Enterprise freeradius authentication certificate currently. My eap.conf 'certificate file' contains the certificate only, not the root and/or intermediates. That seems

Re: WPA Enterprise Certificate renewal for FreeRadius

2012-01-09 Thread Sven Hartge
Mike Diggins mike.digg...@mcmaster.ca wrote: Do the certificates need to be listed in any particular order in the certificate_file? I have had the best experience with the following order: Server-Cert frist then Intermedite-Cert [ then additional Intermedite-Certs ] then Root-Cert The

Re: WPA Enterprise Certificate renewal for FreeRadius

2012-01-09 Thread Alan Buxey
Hi, My question is, what is the value of adding the roots/intermediates to the certificate file i.e certificate_file = ${certdir}/certificate.crt? Does it really allow a client without the Root already installed to verify this certificate? for a client to validate a cert, it needs to

Re: WPA Enterprise Certificate renewal for FreeRadius

2012-01-09 Thread Phil Mayers
On 01/09/2012 07:26 PM, Mike Diggins wrote: Do the certificates need to be listed in any particular order in the certificate_file? I have: server cert intermediate cert ...but as someone has reported having the opposite, I guess the answer is any order. In theory, OpenSSL sorts all that