You might try setting the EAP policy for the CA certificate to always trusted instead of the actual server certificate. I haven't tried this myself before, but it stands a chance of keeping the trust info between renewals of the server cert.

--Mike

On May 13, 2007, at 6:55 AM, Julian Y. Koh wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

At 19:00 -0500 05/03/2007, Julian Y. Koh wrote:
Our SSL cert for our RADIUS server is expiring soon. We've got a renewed certificate all set to load up, but I was wondering how clients behave when presented with the new cert if they've already set up their supplicants to accept the original one. Will users be asked to approve the new cert just like when they first set things up? Or will their supplicants recognize that all that has changed is the expiration date and automatically accept
it?

Well, tests this morning show that the Mac OS X client at least throws up an error saying that "the server certificate is not trusted because there are no
explicit trust settings."  Then you have to go through the certificate
verification again just as if you were setting up the connection for the
first time.

Unfortunately the Windows client that I was planning to use died on me, so I couldn't test that. Looks like hardware failure over the weekend. This
means that I don't know what error message it gives up, if any.


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.0 (Build 214)
Comment: <http://bt.ittns.northwestern.edu/julian/pgppubkey.html>

wj8DBQFGRvzHDlQHnMkeAWMRAr8jAJ9GNvoVSPI6qnp6npaee1AEEc80IQCdFVwn
ubHSz5+tfTWDf7rh+a14DAk=
=CdWx
-----END PGP SIGNATURE-----

--
Julian Y. Koh <mailto:[EMAIL PROTECTED]> Network Engineer <phone: 847-467-5780> Telecommunications and Network Services Northwestern University PGP Public Key:<http://bt.ittns.northwestern.edu/julian/ pgppubkey.html>

**********
Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http:// www.educause.edu/groups/.


**********
Participation and subscription information for this EDUCAUSE Constituent Group 
discussion list can be found at http://www.educause.edu/groups/.

Attachment: smime.p7s
Description: S/MIME cryptographic signature

Reply via email to