3

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication.

Can these certificates be used by the provider to execute man-in-the middle attacks between the user and HTTPS websites that the user is browsing?

Or, are certificates/CAs installed for EAP authentication different from the OS/browser's SSL certificate chain?

If the Passpoint AP provides a self-signed certificate or even a new root CA, does trusting these certificates open the client to MITM attacks while using HTTPS sites on that network?

Also, the screenshots provided by this LinkNYC user here : http://blog.alexflor.es/post/137705262900/linknyc-secure-gigabit-hotspot seem to suggest an entire chain upto a root is provided to be installed on the client. Is the entire chain presented simply because of the EAP-T(TLS) spec (as mentioned in the accepted answer here: Why is a CA certificate required for EAP-TLS clients?)?

Improve this question
3
  • I was not entirely sure how Passpoint worked, the writer of the blog I linked to (and the screenshots there) seemed to suggest that a new root CA cert was installed on the iPhone. I guess that threw me off. What you said, along with the fact that Passpoint systems are required to use pre-defined certs makes much more sense now. It is in fact the client cert that is offered by the Passpoint AP to install on the client device.
    – flak37
    Commented Feb 18, 2016 at 22:10
  • Page 42 confirms it: wi-fi.org/download.php?file=/sites/default/files/private/… >"Passpoint supports user mobile device authentication using a client certificate (EAP-TLS). The client certificate can be issued from any CA the SP prefers and is installed on the mobile device during the manufacturing process or provisioning process."
    – flak37
    Commented Feb 18, 2016 at 22:13
  • @garethTheRed, you should make your comment an answer so it can be upvoted.
    – Neil Smithline
    Commented Feb 19, 2016 at 6:00

1 Answer 1

Reset to default
2

The certificates in your linked images are commercial certificates, therefore your device trusts those already by virtue of the fact that the commercial root CA certificate is in its trust store.

The certificate you installed is probably a client certificate, which you use to authenticate yourself with the system.

It's my (limited) understanding that Passpoint systems must use pre-defined certificates as dictated to by the WiFi Alliance, and not ask you to install an additional root CA certificate in your trust store.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .