MobileFunet meeting 27.1.2021 describing idea how non-routable Windows host certificates could be routed by encapsulating them inside EAP-TTLS authentication. The presentation already includes proof-of-concept tests and plans for future work.

1. ROUTING HOST CERTIFICATES
IN EDUROAM

2. Background
●
●
●
●

3. Idea: Making host certificates routable with EAP-TTLS
●
●
●

4. Idea: EAP-TLS inside EAP-TTLS
EAP-TLS is the inner EAP
authentication protocol for
certificate authentication
Wireless
controller, access
point etc. RADIUS
server
EAP protocol
WPA2 authentication
Outer EAP is EAP-TTLS with a
routable User-Name e.g.
anonhostcert@example.com

5. Idea: How does it actually work?
●
●
●
●

6. TEST SETUPS AND RESULTS

7. Test case 1:
Windows 10 -> WLC -> Radiator (EAP-TTLS) -> Radiator (EAP-TLS)
AD
WLC
RESULT
OK

8. Test case 2:
Windows 10 -> WLC -> Radiator (EAP-TTLS) -> NPS (EAP-TLS)
NPS
AD
WLC
RESULT
FAIL
(so far)

9. Not tested case 3:
Windows 10 -> WLC -> NPS (EAP-TLS)
NPS
AD
WLC RESULT
UNKNOWN
May be possible, but
requires NPS expert to
verify.

10. Future work
●
●
●
●
●
●
●

11. Thank you. Any questions?

12. For more information