WPA Supplicant EAP-TTLS Behaviour Certificate Check

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

need to know how wpa_supplicant behaves if a config like this is applied:

network={
  ssid="SSID"
  key_mgmt=WPA-EAP
  eap=TTLS
  identity="user"
  anonymous_identity="anonymous"
  password="password"
  ca_cert="/etc/ssl/certs/*public-ca*.pem"
  phase2="auth=MSCHAPV2"
}

Would *every* radius certificate signed by this public CA (or chain with this root) be accepted?

Or is there a check against CN / SubjectAltName?


If a constraint is given with

domain_suffix_match=example.com

it does allow radius.example.com,

but does it allow radius.*malicious*example.com?

Or does the configuration has to be prefixed with a dot? To exclude myexample.com?


Like domain_suffix_match=.example.com



Regards

MonkZ



_______________________________________________
Hostap mailing list
Hostap@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/hostap




[Index of Archives]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]

  Powered by Linux