[tpm2] Re: tpm2-pkcs11 and certificates, also Linux Networking

[Steffen Schwebel <s.schwebel at uvensys.de>]

[-- Attachment #1: Type: text/plain, Size: 1415 bytes --]

Hi,

I managed to get that working as well.

I also asked at NetworkManager and wpa_supplicant mailing list.

Seems that NM has support for tpm2-tss at versions > 1.20
Not sure yet about wpa_supplicant.

Since I couldnt store the client cert via PKCS11, I point wpa_supplicant
to a file on disk

client_cert="/home/steffenschwebel/Projects/PKI_network/hardware.crt"
private_key="pkcs11:model=;manufacturer=STMicro;serial=0000000000000000;token=soveryimportant;id=%F2%BE%D0%AB%C3%81%72%8A%B5%40%69%31%D1%38%28%8C%9D%BB%EE%9E;object=klarna;type=private"
pin="456456"
				
regards,
Steffen	
				

On 1/16/20 7:49 PM, nicolasoliver03(a)gmail.com wrote:
> Hi Steffen,
>
> In our side, we were able to get wpa_supplicant, tpm2_pkcs11, and EAP-TLS to authenticate a device in a corporate network.
> It requires a wireless AP or router that supports EAP-TLS, and a Radius server for auth. 
>
> There is a thread in this mailing list about that here https://lists.01.org/hyperkitty/list/tpm2(a)lists.01.org/thread/AYUBCAFCCXITEVSWA4IFC466LYS6ZIYX/
> There are also commits in tpm2-pkcs11 to enable support for wpa_supplicant https://github.com/tpm2-software/tpm2-pkcs11/pull/366
> _______________________________________________
> tpm2 mailing list -- tpm2(a)lists.01.org
> To unsubscribe send an email to tpm2-leave(a)lists.01.org
> %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s