1. 802.1x Radius Certificate Migration Doomsday…
University of Denver
Marcelo Lew
CHECO
Spring 2014

2. Chronology of Events
February 16, 2014 around noon. Information Security replaced our production Radius servers’ certificates from Thawte to Incommon (Comodo). The thought was that this would be transparent to the end user.
Problem:
Incommon Root Certificate is not listed/installed in most systems by default as a “Trusted Root Certificate Authority”
So when users try connecting…

3. Users got the following error (Windows):
MacOS had similar results.

4. Frustrated users, angry emails, 100s of support tickets/Incidents etc..

5. How to prevent this?
If the certificate would have been installed ahead of time, even not trusted, then the error would have been:
By clicking the continue button the certificate would have been trusted and the connection formed.

6. Solution
We needed a way to quickly distribute this new Root Certificate to the clients
And have it trusted by the system!
We re-coded our CloudPath XpressConnect software with the new certificate and had all users run it.
There was a significant delay getting the new XPC working right due to using the wrong Incommon Root Certificate, which is called AddTrust External CA Root (not the Incommon Root CA).
After running XpressConnect, this certificate now shows up in the Certificate Manager and EAP Properties for Windows and in the Keychain for MacOS.

10. Lessons Learned from Incident
Do not change Radius Certs during academic session – plan ahead!
Know and understand when your Radius and web portal certs expire in your secure wireless environment
Inform all IT Support Staff on this change.

11. Device / Identity Certificates Instead of cached User Credentials? DU
Device / Identity Certificates
Instead of cached User Credentials?
Move the Radius function to an “Enrollment” type product?
EG:
CloudPath’s Enrollment System (ES)
Aruba ClearPass
Cisco ICE