Re: Unable to connect to eduroam

[James Prestwood <prestwoj@gmail.com>]

HI Michael,

On 2/23/24 6:25 AM, Michael Yartys wrote:
> Hi
>
> I'm running iwd 2.14 on Fedora 39 Silverblue with kernel version 6.7.5-200.fc39.x86_64, and I've been having issues for the last two weeks or so connecting to my university eduroam network. What happens is that I get an internal error that causes the connection attempt to fail with eapFail. Here's the log output with TLS debugging enabled:
<snip>
>
>
> I'm sure these certificates are correct because I was able to roll back to a working build on Fedora Silverblue to keep connecting to the network. Unfortunately, I was dumb enough to forget to pin/freeze that working build to prevent it from being replaced by new versions as I continually updated the system.
>
> I searched a bit around and found that some other folks had experienced the same issue on Arch: https://bbs.archlinux.org/viewtopic.php?id=291921
>
> That thread links to another thread about the deprecation of SHA-1 in the kernel: https://bbs.archlinux.org/viewtopic.php?id=292208
>
> rochus from the first thread was able to connect to their eduroam network when they tried a kernel with the offending commit reverted. Now, I know very little about certificates, but no certificates in my cert chain are SHA-1 signed, are they? Could this still be related to the issue I'm experiencing?

Yep it appears the issue is a lack of SHA1 in the kernel.

I'm not that familiar with TLS but based on the code RSA certs use 
PKCS1, which requires SHA1 (someone correct me if I'm wrong).

The kernel apparently removed this... they did (or are doing) the same 
thing for MD5. I guess we need to roll our own.

Thanks,

James

>
>
> Michael
>