Why is a CA certificate required for EAP-TLS clients?

Question

When setting up clients with WPA2 EAP-TLS, most clients (ie: my phone, my computer) require both a client public/private keypair (for obvious reasons) and a certificate authority certificate.

It's this second parameter which I'm not sure of the use for. My current setup looks like this:

.
└── root-ca
    ├── wifi-client-ca
    │   └── client1-client-cert
    └── wifi-server-cert

I have a single self-signed root CA (root-ca) which branches off underneath. My RADIUS server uses wifi-server-cert as the SSL certificate, and uses the wifi-client-ca certificate authority for validating client certificates.

I use chain certificates in deployment everywhere, both for the client and serverside certificate components.

I haven't had any trouble connecting using client1-client-cert and wifi-client-ca on my Ubuntu machines, but I haven't been able to connect on Android using these same certificates. I'm thinking that the problem lies in the fact that Android isn't climbing the certificate chain properly.

This breaks down into two similar questions:

1. Why is a CA certificate required for EAP-TLS clients/what does it do?
2. Which CA certificate should be used on my clients, the root-ca certificate (which directly signs the wifi-server-cert) or the wifi-client-ca?

Answer 1

EAP-TLS really encapsulates a SSL/TLS handshake, in which both server and client send each other a certificate. This has the following properties:

• When the server sends a certificate, it actually sends a certificate chain, including the CA which issued it, and the CA above it, and so on, up to the root (the root itself may be sent, but this is optional).
• Similarly, when a client sends a certificate, it also is as part of certificate chain.
• The client validates the server's chain, the server validates the client's chain.

Therefore, on the client side, with your notations:

• The client must know wifi-client-ca because it must send it as part of its "client chain" to the server.
• The client must know and trust root-ca in order to be able to validate the server's certificate (this is crucial for security: this protects the client from talking to a fake access point).

Some clients might be convinced to trust wifi-server-cert directly, but not all of them permit such direct trust, and it would mean trouble when that certificate expires.

It may be enlightening to consider the following: the client's certificate is for the server, not for the client itself; thus, the client needs not trust its own certificate. In a generic way, the root CA for the server certificate, and the root CA for the client certificates, may be distinct and unrelated to each other. Still, the client must know (but not necessarily trust) the chain for its own certificate in order to send it to the server, as SSL/TLS mandates.