I've got a home network configured with a RADIUS server that only handles EAP-TLS authentication, and I'm attempting to get this scheme to work well on Windows. Everything works great, but in order to perform server authentication (see image 1) I have to add the self-signed certificate authority to the local machine trusted root certificate store. If I'm not mistaken, this might result in browsers and other request agents trusting the CA for HTTPS web requests, and I'm not comfortable with that. It looks like I can set the certificate to "Disable all purposes for this certificate" (see image 2) - is that enough to prevent the certificate from being trusted to authenticate any web requests?

trust dialog certificate dialog

  • Didn't you create that root CA yourself? Are you afraid you leaked its private key, and now someone's going to issue a bunch of server/network certs using your own CA? Or did you already use your CA to issue a bunch of server/netwrk certs for well-known sites? Having your clients trust your own root CA is perfectly fine; they won't connect to impostor sites/networks unless you issued certs for those sites/nets from that CA. If you're really paranoid and don't need to issue any more server/network certs from that CA, destroy its private key so no one can issue any certs from that CA ever again. – Spiff Jun 9 at 16:45
  • I did create the root CA myself. It's more of a separation of concerns, predicated on my particular threat model - the CA is exclusively to be used for authenticating clients to access points, and I don't want to increase the potential attack surface given that the device that hosts the RADIUS server is theoretically vulnerable to attack. Should that CA get out, if I manage to not trust the CA cert for other purposes, it would only slightly weaken network security, and would only do so for physically proximal actors. – skeggse Jun 9 at 18:37
  • I provided the context to try and inform the response, but I think the question exists irrespective of the context. Perhaps this was a cert issued by another organization, and I have to connect to their WiFi for whatever reason, and I don't fundamentally trust their IT department to manage their certs well. – skeggse Jun 9 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.