2

I'd like to run FreeRADIUS for EAP TLS authentication but instead of running my own Certification Authority I'd like to use StartSSL.

I've setup EAP TLS with StartCom as the only Trusted Root CA and that works ok, but means anyone with a StartSSL Certificate could connect to my network.

I would like to allow access based on the client certificate Common Name something like check_cert_cn = *@example.com but I don't seem to be able to use a wild card in the check_cert_cn value.

Is there a way to achieve this? I might be approaching this problem the wrong way, should I be looking at realms or something? or just accept it and run my own CA.

2

So after a bit of digging I came across a commit on GitHub that can do this.

I uncommented virtual_server = check-eap-tls in eap.conf

Then create check-eap-tls in sites-available and symlinked it to sites-enabled:

server check-eap-tls {
  authorize {
    if ("%{TLS-Client-Cert-Common-Name}" =~ /^[A-z.]*@example\.com$/) {
      update config {
        Auth-Type = Accept
      }
    }
    else {
      update config {
        Auth-Type = Reject
      }
      update reply {
        Reply-Message = "Your certificate is not valid."
      }
    }
  }
}

Using =~ instead of == allows you to use regular expressions and in my all the certificates will be alpha with a dot so ^[A-z.]*@example\.com$ works for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.