Re: Unable to connect to eduroam

[Denis Kenzior <denkenz@gmail.com>]

Hi Michael,

> 
> I'm sure these certificates are correct because I was able to roll back to a working build on Fedora Silverblue to keep connecting to the network. Unfortunately, I was dumb enough to forget to pin/freeze that working build to prevent it from being replaced by new versions as I continually updated the system.

Do you have any clue what changes you made to the working build?  iwd hasn't 
touched certificate bits for a number of releases now.

> 
> I searched a bit around and found that some other folks had experienced the same issue on Arch: https://bbs.archlinux.org/viewtopic.php?id=291921
> 
> That thread links to another thread about the deprecation of SHA-1 in the kernel: https://bbs.archlinux.org/viewtopic.php?id=292208

Someone should complain to the linux-crypto folks for breaking uapis and have 
that change reverted.

> 
> rochus from the first thread was able to connect to their eduroam network when they tried a kernel with the offending commit reverted. Now, I know very little about certificates, but no certificates in my cert chain are SHA-1 signed, are they? Could this still be related to the issue I'm experiencing?

I can't dump the second certificate for some reason, but the first has:
[denkenz@archdev ell]$ openssl x509 -in cert2.pem -text
...
     Signature Algorithm: ecdsa-with-SHA256

Do you have CONFIG_ECDSA=y in your kernel?

[denkenz@archdev ell]$ zless /proc/config.gz | grep ECDSA
CONFIG_CRYPTO_ECDSA=y
CONFIG_MODULE_SIG_KEY_TYPE_ECDSA=y

Regards,
-Denis