Last updated: 
1 week 1 day ago
Group Manager
A place to share information on all aspects of eduroam in the UK. Follow us on Twitter @eduroamuk - for news, interest, information, photos and fun. Contents Click on item and scroll down to the selected content at the bottom of the page. eduroam Visitor Access Administrator Manual - Configuration and Management eduroam Visitor Access Portal User Manual - Creating Guest Accounts eduroam Visitor Access User Manual - Creating Guest Accounts for Groups and SMS Events eduroam Visitor Access Guide - UKAMF IdP Configuration Requirements Advisory: Injection of Operator-Name at the NRPSs Walled Garden for Onboarding User Devices to eduroam Using eduroam Support site; Connecting to the NRPS; User on-boarding – CAT Guidance document - eduroam and Safeguarding Guidance document - Cost of Implementing eduroam eduroam(UK) Technical Specification Summary of Recommendations Checklist eduroam(UK) Technical Specification Summary of Requirements Checklist eduroam(UK) Technical Specification NHS and eduroam/shared use of wireless/govroam ORPS in Azure - alternatives to the use of ICMP Sending Operator Name with Cisco ISE 2.0 eduroam in Public Buildings and Spaces in City Centres TLS 1.2 and updated RADIUS requirements FreeRADIUS Packet Handling - examining the flow FreeRADIUS Best Current Practice Configuration for eduroam  Performance tweaks for RADIUS and backend authentication systems eduroam(UK) Microsoft NPS Configuration Guide eduroam(UK) Service Provider Assurance Tool User Guide eduroam(UK) Service Provider Assurance Tool Phase2 Field Trial Feedback Improving the Reliability of NPS as an Authenticator in eduroam Advisory: Using Status Server Advisory: Use of MD5 Certificates Deprecated in Favour of SHA-1 for RADIUS servers Advisory: Windows Mobile 8 and Certificate Verification NWS41 eduroam Forum presentations - TKIP, CUI, NAPTR, QoS Probe NWS40 FreeRADIUS Demystified seminar presentation Geant Funding available Janet Lumen House eduroam Service Information UK eduroam Usage Feb 2013 EAP-pwd Moving Towards a Deployable Standard Site Finder and Service Information Directory eduroam(UK) Technical Specification 1.3 (archived) - superseded by 1.4 eduroam User Troubleshooting Flowchart for IT Support Staff eduroam Administrators Troubleshooting Flowchart NAPTR Record Creation Using Microsoft Windows 2008 R2 DNS Server eduroam Best Practice Pointers FreeRADIUS 2 eduroam Deployment at University of Sussex

Group administrators:

Windows Mobile 8 and certificate verification

17 April 2014 at 4:38pm

Announcement regarding Windows Mobile 8 and 802.1X authentication with certificate validation

Best practice is that clients must be configured to trust/verify the CA that signs
the RADIUS server that presents during an 802.1X authentication - a major security
pin for eduroam is this trust/check.

It has been noted that Windows Mobile 8 (WM8) devices would not authenticate the user
if this 'verify' option was chosen.

Research undertaken within GEANT members, the UK 802.1X SIG and verified by eduroam UK
support is that this is due to WM8 requiring an extra attribute in the RADIUS server
cert (note, we have verified that successful authentication can occur if ONLY the
RADIUS server cert has this attribute present). The attribute is the Certificate Revocation
List (CRL) Distribution Point (CDP) e.g.

crlDistributionPoints = URI:http://www.example.ac.uk/example.crl

For Windows Mobile 8 to have proper/safe 802.1X authentication your RADIUS servers
will need to have such an attribute present - we are just awaiting feedback/confirmation
as to whether things work if only the CA cert has this attribute (not something
that we can test in the short term)

Alan