3

I am currently trying to connect to an enterprise network through wpa_supplicant,

I am using the file: /etc/wpa_supplicant/wpa_supplicant.conf

The network is PEAP MSCHAPV2

I am using this code I got here.

network={
ssid="CORPORATE"
scan_ssid=1
key_mgmt=WPA-EAP
eap=PEAP
identity="NBroza1"
password="XXXXXXX"
ca_cert="/etc/cert/ca.pem"
phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
}

I am confused about this line: ca_cert="/etc/cert/ca.pem"

My raspberry pi (raspberian jessie full img) does not have a file called /etc/cert/ca.pem. I was wondering if when I deploy this, it will work or not regardless of having that file, or even if I delete that line.

My question is: "Will it work if I delete this line, or is there a way I can get the file: /etc/cert/ca.pem"?

1

The CA certificate is used to guarantee that you are connecting to the correct server. Otherwise, You may try to connect to a fake WLAN with the same name as yours (you think it is yours because it has the same name) and that WLAN is connected to a fake server that will steal your identity (username, password...etc.). The CA certificate file you put here (in supplicant config) is generated by the server and guarantees that you are authenticating through the correct (not fake or illegitimate server). That's why you'll find that the certificate is highly recommended.

If you omit using the certificate (or, if you are using the certificate but you are connecting to a fake server), the connection may or may not work based on the supplicant type and version (in most modern supplicants it will issue a warning telling you that the supplicant thinks that this is a fake server and gives you the choice if you'd like to proceed connecting to it.

I don't have an authentication server to try with, but I think your authentication will fly if you omit the certificate file part. However, you will possibly be prompted for a warning everytime you try to connect.

HTH

0

The below worked for me on a Cisco WiFi Network:

network={
    ssid="nameofSSID"
    proto=RSN
    key_mgmt=WPA-EAP
    pairwise=CCMP
    auth_alg=OPEN
    eap=PEAP
    identity="username"
    password="password"
    phase2="auth=MSCHAPV2"
}
0

I happen to have a similar configuration that is used at a local University. They say in their documentation:

"ca_cert" is optional but highly recommended. The location of the Thawte Premium Server CA certificate file may be different depending on your distribution. You may need to a ca–certificate package or download the certificate directly from Thawte.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.