2

I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method. I have used this old tutorial for setting up my own CA and generating the certificates and adjusted the older parameters to match the current ones.

So far I managed to authenticate my iPhone 6 running iOS 11.1.2 as a test device, for that I have:

  • Installed the root CA's(the one I created) certificate on my iPhone
  • Installed a test identity profile on my iPhone with the name "Test" and test passphrase, which I converted to a .p12 file

Now when I connect to the network with the freeradius server running in debug mode, I can select EAP-TLS as the auth type and tell it to use the identity certificate. It then prompts me to trust the server's certificate and I get a successful connection.

I have 2 questions:

  1. Why do I need to trust the server's certificate if I have the root CA's certificate installed? As far as I understood the way the authentication works is as follows:
  • The server and client each send their respective certificate for the other party to authenticate with the root CA's certificate. After both are completed there is an optional challenge for the client to complete? (I'm not sure about this) and the client is authenticated

  • The server doesn't need to be told to explicitly trust the client certificate but the client needs to explicitly trust the server's even though they are both issued and signed by the same root CA and both parties have the certificate needed to be able to verify it

  • AFAIK the whole point of certificate-based authentication is to prevent MiTM attacks that other methods are vulnerable against. If the user initially connects to a spoofed access-point and accepts that certificate it will refuse the correct RADIUS server and leak the client certificate to the wrong server, this would be avoided if the client can verify the server certificate on its own without user intervention

  1. There is a username option when selecting the network on the iPhone, which does get matched against a backend SQL database by the freeradius server regardless of that username existing the server accepts the authentication. This page notes that the username is used in inner and outer authentication but to me, that doesn't seem to make sense as there is no inner and outer identity in EAP-TLS. I assume there is a way to tell the radius server to only accept requests that match a username in the database but if it is not configured that way by default what is the point? Doesn't the certificate already uniquely identify the device/user and what is the point of the username field if anything can be entered?

I would appreciate an explanation to these concepts, I'm relatively new to certificate-based authentication and RADIUS in general so I'm still learning the basics.

The goal of this endeavor is to deploy the server in an eduroam-like environment where users can generate certificates for their devices on some website, download the two needed certificates and get access without having to trust another.

I should also note that I have complete access and control over the server and my CA so I can modify anything as needed, so no quirky workarounds here.

1 Answer 1

1

Please bear in mind that whatever you are trying to use is dependent of mutual support on the server/authenticator and client sides. This is not always trivial to achieve.

Why do I need to trust the server's certificate if I have the root CA's certificate installed?

This behaviour is entirely dependent on the client's implementation (the supplicant). Yes having the server cert signed by the CA should be seen as a significant proof of trust, provided it's not expired or revoked (if the client checks).

On a windows workstation for example you can either trust CAs specifically or let the user review and accept the server side certificate at the first connection. But if the server side cert is signed by one of the selected CAs, the user doesn't get a dialog about the cert.

AFAIK the whole point of certificate-based authentication is to prevent MiTM attacks that other methods are vulnerable against.

Conceptually it is instead about mutual authentication, and providing solid proof to the client that the server is being spoofed. It is up to the client to decide what to do with that information. Hopefully and usually it drops the connection. If not, it's as much at risk of MiTM as if it didn't use cert based authentication.

There is a username option when selecting the network on the iPhone, which does get matched against a backend SQL database by the freeradius server regardless of that username existing the server accepts the authentication. This page notes that the username is used in inner and outer authentication but to me, that doesn't seem to make sense as there is no inner and outer identity in EAP-TLS.

Conceptually you could have another EAP authentication dialog within the EAP-TLS channel once that is established. For example EAP-TTLS is often used to protect less secure authentication protocols like PAP. So this is left as an option for the server and client implementations to negotiate through the existing supported protocols and/or custom implementations. This could also be used for a kind of multi factor authentication whereby a station and a user authenticate separately so that the admin can revoke access to the device or the user independently.

2
  • Just to clarify: In theory the CA's certificate should be enough but because it is implementation dependent that may not always be that case? This still seems like a loophole to me if the first time you connect to the access-point the server gets spoofed and the user clicks trust anyway because it isn't shown as potentially dangerous, although I haven't tested what happens if the server cert is invalid, I will try that now. Jul 2, 2020 at 15:45
  • Yes you need to test all cases to see what happens. Have a signed cert, have one that has an unverifiable signature, swap a valid cert for another valid cert, swap a valid cert for an invalid one.
    – Pedro
    Jul 2, 2020 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .