Please provide option to make NetworkManager verify only the root certificate of the signed cert chain (WPA2-Enterprise)

[Patrick Brueckner]

I have to use a chain certificate, that had all certificates involved in the verification of the AP. this seems uncomfortable and breaks design (of at least the eduroam networks).

The (German) eduroam networks are all signed with a certificate of the corresponding university or college CA, which is signed by the DFN (german scientific network) which is signed by Deutsche Telekom Root CA (installed by default on ubuntu)

By opting to verify the complete chain, I have to set up various configurations for various locations.

The eduroam network is designed to enable students from all over the world to log in to worldwide higher education networks with their home-university's login.

There should be an option to only verify the root certificate of the signed cert chain.

[Thomas Hood (jdthood)]

I found this relevant page: http://rwth.bernd-jantzen.de/eduroam/

[Mathieu Trudel-Lapierre (cyphermox)]

Confirming; eduroam is just a huge pain to connect to and has been for a long while now; we should take any opportunity to fix the issues that are found.

Sadly, my university doesn't belong to eduroam yet, so I will be unable to test a fix; but I'll look at the code to see if there's a simple way to figure this out. Unfortunately, I suspect there may be some things to tweak in how wpasupplicant speaks to openssl for this to get fixed.

Perhaps as a good data point; could you try to configure your system to use just wpasupplicant to connect to that network, and see if it works better or if there is still a need for the whole chain to be validated? This would at least confirm whether there are changes to be done in NetworkManager itself.

[Patrick Brueckner (madmuffin)]

I am currently on semester break, and will not be in university before october, maybe someone else can jump in earlier?

[Albert Pool (albertpool)]

Is this still necessary after #1104476 has been fixed? If not, this bug can be closed.

[Patrick Brueckner (madmuffin)]

I'm going to verify if the fix in #1104476 is sufficient or if any changes need to be made to network-manager

[Patrick Brueckner (madmuffin)]

Though #1104476 it is a different solution for the problem, it should work with the new fix, as it allows to connect without verifying the certificates. (Tested just now)

[Tony Espy (awe)]

Just moved this to Incomplete, as it's been posited that the fix for bug #1104476 resolves the issue.

If anyone can confirm that this is still broken, we can investigate further.

[Launchpad Janitor (janitor)]

[Expired for network-manager (Ubuntu) because there has been no activity for 60 days.]