<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">> For an organisation
that already uses eduroam, the CAT tool can simplify</span><br>
</div>
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">> configuration substantially.
It does not replace manual configuration or</span><br style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255)">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">> other tools - it's
just another way to set up a device.</span><br>
</div>
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">It's worth pointing out
that it is getting increasingly difficult to do manual configuration of devices for connection to Enterprise networks, devices vendors are now starting to mandate that onboarding tools are used that use the APIs to setup a profile. And if not that, increasingly
stringent requirements that make manual configuration more difficult and error-prone, eg Android requiring the obscurely-named "Domain" to be completed with the subject name of the radius server certificate.</span></div>
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">So needing geteduroam,
securew2, etc.</span></div>
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<span style="font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">Jethro.</span></div>
<div>
<div style="font-family: "Segoe UI", "Helvetica Neue", sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family:"Segoe UI","Helvetica Neue",sans-serif; font-size:10pt; color:rgb(0,0,0)">
<p>.<span style=""> </span>.<span style=""> </span>.<span style=""> </span>.<span style="">
</span>.<span style=""> </span>.<span style=""> </span>.<span style=""> </span>
.<span style=""> </span>.<span style=""> </span>.<span style=""> </span>.<span style="">
</span>.<span style=""> </span>.<span style=""> </span>.<span style=""> </span>
.<span style=""> </span>.<span style=""> </span>.<span style=""> </span>.<span style="">
</span>.<span style=""> </span>.<span style=""> </span>.<span style=""> </span>
.<span style=""> </span>.<span style=""> </span>.<span style=""> </span>. </p>
<p>J<span style="font-family:"segoe ui","helvetica neue",sans-serif; font-size:10pt; color:rgb(0,0,0); background-color:rgba(0,0,0,0)">ethro R Binks, Network Manager,</span><span style="font-family:"segoe ui","helvetica neue",sans-serif; font-size:10pt; color:rgb(0,0,0); background-color:rgba(0,0,0,0)"> </span></p>
<p><span style="color:rgb(0,0,0); font-family:"segoe ui","helvetica neue",sans-serif; font-size:10pt; background-color:rgba(0,0,0,0)">Information Services Directorate, University Of Strathclyde, Glasgow, UK</span></p>
<p><span style="color:rgb(0,0,0); font-family:"Segoe UI","Helvetica Neue",sans-serif; font-size:10pt"><br>
</span></p>
<p><span style="color:rgb(0,0,0); font-family:"segoe ui","helvetica neue",sans-serif; font-size:10pt; background-color:rgba(0,0,0,0)">The University of Strathclyde is a charitable body, registered in</span><span style="font-family:"segoe ui","helvetica neue",sans-serif; font-size:10pt; color:rgb(0,0,0); background-color:rgba(0,0,0,0)"> </span><span style="color:rgb(0,0,0); font-family:"segoe ui","helvetica neue",sans-serif; font-size:10pt; background-color:rgba(0,0,0,0)">Scotland,
number SC015263.</span></p>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<div style="font-family:"Segoe UI","Helvetica Neue",sans-serif; font-size:10pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> radiator <radiator-bounces@lists.open.com.au> on behalf of Heikki Vatiainen <hvn@open.com.au><br>
<b>Sent:</b> 09 September 2021 15:37<br>
<b>To:</b> radiator@lists.open.com.au <radiator@lists.open.com.au><br>
<b>Subject:</b> Re: [RADIATOR] Certificate Not Trusted - InCommon?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">On 8.9.2021 19.48, Ullfig, Roberto Alfredo wrote:<br>
<br>
> Bringing this back, the main question I have is why do our users need to <br>
> Trust a certificate when connecting to our Radius Wifi but they don't <br>
> need to Trust a certificate when connecting to most other WiFi services <br>
> out there. Why is there a difference?<br>
<br>
Are the other WiFI services, for example, WLANs that require <br>
authentication using a captive portal?<br>
<br>
I'd say that in all cases authentication to WLANs that use <br>
WPA-Enterprise with an EAP method that is based on TLS, trust needs to <br>
be established manually by the user, with a profile or a tool that <br>
automates this. For example <a href="https://cat.eduroam.org/">https://cat.eduroam.org/</a><br>
<br>
If the above, the difference is that the browser knows that the server <br>
must have a certificate for example.org if the target URL is <br>
<a href="https://example.org">https://example.org</a><br>
<br>
With TLS based RADIUS as used by WPA-Enterprise, a WPA-Enterprise <br>
client only knows the WLAN name (SSID) but there's nothing in the <br>
certificate a RADIUS server sends, at least currently, that ties <br>
together the certificate and the current SSID.<br>
<br>
For an organisation that already uses eduroam, the CAT tool can simplify <br>
configuration substantially. It does not replace manual configuration or <br>
other tools - it's just another way to set up a device.<br>
<br>
Thanks,<br>
Heikki<br>
<br>
-- <br>
Heikki Vatiainen<br>
OSC, makers of Radiator<br>
Visit radiatorsoftware.com for Radiator AAA server software<br>
_______________________________________________<br>
radiator mailing list<br>
radiator@lists.open.com.au<br>
<a href="https://lists.open.com.au/mailman/listinfo/radiator">https://lists.open.com.au/mailman/listinfo/radiator</a><br>
</div>
</span></font></div>
</body>
</html>