Re: WPA2-Enterprise and server certificate verification

On Mon, 2016-02-08 at 12:09 +0100, Christian Hesse wrote:
Hello everybody,

when networkmanager connects to a WPA/WPA2-Enterprise secured notwork
it can
check the validity of the server certificate against a CA

Connecting to the authentication server does not include a domain
though. So by default there is no way to check the certificate CN
value. This
results in a potential security issue: If anybody has a certificate
*any* CN issued by the same CA networkmanager will accept it as
An attacker can set up access points with same SSID and forged
server to phish user credentials and redirect network traffic.

Since version 2.1 wpa_supplicant supports configuration option
'domain_suffix_match' to manually specify a domain (suffix) to match
server certificate against. 'domain_match' was added later on.

I would like to see a configuration option within networkmanager for
setting. Any chance to add that?

Yes, it's come up recently on too and it should
likely get added alongside the existing subject matching support.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]