When setting up clients with WPA2 EAP-TLS, most clients (ie: my phone, my computer) require both a client public/private keypair (for obvious reasons) and a certificate authority certificate.
It's this second parameter which I'm not sure of the use for. My current setup looks like this:
. └── root-ca ├── wifi-client-ca │ └── client1-client-cert └── wifi-server-cert
I have a single self-signed root CA (
root-ca) which branches off underneath. My RADIUS server uses
wifi-server-cert as the SSL certificate, and uses the
wifi-client-ca certificate authority for validating client certificates.
I use chain certificates in deployment everywhere, both for the client and serverside certificate components.
I haven't had any trouble connecting using
wifi-client-ca on my Ubuntu machines, but I haven't been able to connect on Android using these same certificates. I'm thinking that the problem lies in the fact that Android isn't climbing the certificate chain properly.
This breaks down into two similar questions:
- Why is a CA certificate required for EAP-TLS clients/what does it do?
- Which CA certificate should be used on my clients, the
root-cacertificate (which directly signs the
wifi-server-cert) or the