<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Calibri Light";
panose-1:2 15 3 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Greetings,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So, using Radiator to authenticate our wifi access points, and it has been brought to my attention that iPhones show my commercially purchased GoDaddy certificate is “Not trusted”. I think this is the relevant part of the config file.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So, GoDaddy provides a certificate (xxxxxxx.pem) and their intermediate / root bundle: gd_bundle-g2-g1.crt.
<o:p></o:p></p>
<p class="MsoNormal">I originally had EAPTLS_Certificate pointing to xxxxxxx.pem from GoDaddy, and EAPTLS_CAFile pointing to gd_bundle-g2-g1.crt.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So, since then, I’ve tried various permutations -- the most recent of which is below. server.pem = xxxxxx.pem + the intermediate certificates from gd_bundle-g2-g1.crt. And EAPTLS_CAFile is pointing to gd-class2-root.crt, which is the
root certificate portion of gd_bundle-g2-g1.crt. Still same error. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am trying to avoid having to install the intermediate certificate on every iPhone out there --for one thing, in this BYOD world, I don’t know that I should be installing on people’s personal devices.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Suggestions or explanations of what I’m doing wrong would be appreciated. Oh, and I think I’m running Radiator 1.143 -- it’s pretty old.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> -p<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:Consolas">#### Wireless Clients using PEAP #####<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"># The most popular method, suported by default by Windows. Does not require a client-side cert and is thus considered less secure<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"># than EAP-TLS<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><Handler TunnelledByPEAP=1><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> RejectHasReason<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> AuthLog wifi-authlog<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> <AuthBy NTLM><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_CertificateChainFile /etc/pki/tls/certs/server.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_PrivateKeyFile /etc/pki/tls/private/server.key<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_CAFile /etc/pki/tls/certs/gd-class2-root.crt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> NtlmAuthProg /usr/bin/ntlm_auth --helper-protocol=ntlm-server-1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> Domain XXXXXXX<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> DefaultDomain XXXXXXX<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPType MSCHAP-V2,PEAP,TTLS<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_PEAPVersion 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_CertificateType PEM<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_MaxFragmentSize 1024<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPAnonymous %0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> SSLeayTrace 4<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> </AuthBy><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"></Handler><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas">#### Outer Handler #####<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"># When clients check the 'Validate Server Certificate' (or equivalent), then this stanza plays a key role<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><Handler><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> AuthByPolicy ContinueUntilAccept<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> AuthLog wifi-authlog<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> RejectHasReason<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> <AuthBy FILE><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> Filename %D/users.anonymous<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPType PEAP,TTLS<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_PEAPVersion 0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_CertificateChainFile /etc/pki/tls/certs/server.pem<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_PrivateKeyFile /etc/pki/tls/private/server.key<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_CAFile /etc/pki/tls/certs/gd-class2-root.crt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_CertificateType PEM<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPTLS_MaxFragmentSize 1024<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> EAPAnonymous %0<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> AutoMPPEKeys<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> SSLeayTrace 4<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"> </AuthBy><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas"></Handler><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Calibri Light",sans-serif;color:black">--</span><br>
Pat Hirayama<br>
Systems Engineer / 206.667.4856 / phirayam@fredhutch.org / Fred Hutch / Cures Start Here
<o:p></o:p></p>
<p class="MsoNormal">CIT | Advancing IT and Data Services to Accelerate the Elimination of Disease<span style="font-family:"Calibri Light",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>