Freeradius and self signed-certificate

Question

our current wi-fi infrastructure is based on a Debian box that hosts Freeradius with LDAP backend. Currently we have two 802.1x protected SSIDs, a public and a private network: depending on an LDAP attribute, an user can connect to the first or to the second network.

Since our Freeradius has self-signed certificate, we are having some troubles with Windows 7 clients, that need server certificate installed to perform the connection: this is a bit annoying especially for public network, because we need to setup every pc that comes in.

I was wondering if there is a way (other than buying a commercial certificate for freeradius, sadly I read [ http://wiki.freeradius.org/guide/Certificate-Compatibility ] that Windows client does not accept wildcard certificates, that we already have...) to make clients accept that certificate easier: a workaround could be logging through a captive portal? Is it possible to set up a captive portal only for the public network?

Answer 1

The supplicant cannot verify the CN in the certificate, so you could present any certificate to the supplicant (other than wildcard certs) and it would work.

You really have no choice other than to install a local CA, or get a certificate signed by a trusted commercial CA.

In terms of captive portals, it is not possible to fallback to a captive portal on a WPA/2-Enterprise network.

You could setup a 3rd unencrypted SSID with a captive portal to help users bootstrap, providing wireless network configurations, and certificates.

This is a common practice in academic networks where something like Cloudpath xpressconnect, or eduroam cat is used to deploy configurations.

Answer 2

Eventually we moved our public WiFi from 802.1x to unencrypted + CoovaChilli captive portal. Authentication is still based on Freeradius + LDAP, shared with private network, that we left unchanged on 802.1x .

We were able to keep separate WLANs with different authentication methods because clients are kept in two separate VLANs and LANs, and our access points allow to broadcast multiple SSIDs per antenna.

CoovaChilli behaves very well with Windows 7/8 clients (no certificate requests, a popup appears telling the user to login from browser), Android/iOS devices recognize captive portal and redirect the user to login web page.