Re: Security for the IETF wireless network

Stefan Winter <stefan.winter@xxxxxxxxxx> · Fri, 25 Jul 2014 17:32:20 +0200



    Hi,

    
            Sorry, I assumed that this was just an annoying dialog
              and there was a checkbox for "do it anyway".  We will have
              to find a way to manage the usability on Windows, whether
              that means "buy a cert from someone who is in Microsoft's
              default trust list too" or "provide instructions for
              Windows users" or what.
            

    A common misunderstanding. There *is no* default trust list for IEEE
    802.1X purposes. Even on Microsoft, you have to tick the checkbox on
    the one CA you trust for this connection. Due to that, whether you
    paid for a commercial CA's cert or just created a self-signed one
    doesn't matter; self-signed simply adds the extra step of importing
    the CA in the first place. Both need the user to TheRightThing(tm).

    
    The instruction can be "use this .exe that we provide, it will push
    the right knobs for you." That's why I mentioned my website which
    gives you such installers. 

    
    Stefan

    
Attachment:
0x8A39DC66.asc

Description: application/pgp-keys
Attachment:
signature.asc

Description: OpenPGP digital signature