802.1x Radius Certificate Migration Doomsday… University of Denver Marcelo Lew CHECO Spring 2014

Chronology of Events February 16, 2014 around noon. Information Security replaced our production Radius servers’ certificates from Thawte to Incommon (Comodo). The thought was that this would be transparent to the end user. Problem: Incommon Root Certificate is not listed/installed in most systems by default as a “Trusted Root Certificate Authority” So when users try connecting…

Users got the following error (Windows): MacOS had similar results.

Frustrated users, angry emails, 100s of support tickets/Incidents etc..

How to prevent this? If the certificate would have been installed ahead of time, even not trusted, then the error would have been: By clicking the continue button the certificate would have been trusted and the connection formed.

Solution We needed a way to quickly distribute this new Root Certificate to the clients And have it trusted by the system! We re-coded our CloudPath XpressConnect software with the new certificate and had all users run it. There was a significant delay getting the new XPC working right due to using the wrong Incommon Root Certificate, which is called AddTrust External CA Root (not the Incommon Root CA). After running XpressConnect, this certificate now shows up in the Certificate Manager and EAP Properties for Windows and in the Keychain for MacOS.

Lessons Learned from Incident Do not change Radius Certs during academic session – plan ahead! Know and understand when your Radius and web portal certs expire in your secure wireless environment Inform all IT Support Staff on this change.

Device / Identity Certificates Instead of cached User Credentials? Future @ DU Device / Identity Certificates Instead of cached User Credentials? Move the Radius function to an “Enrollment” type product? EG: CloudPath’s Enrollment System (ES) Aruba ClearPass Cisco ICE