[INFO] Does not currently work for Ghent University (Belgium) because of certificate change

martinius96 / ESP32-eduroam

Examples with connection to eduroam powered university networks around the world and then to IoT services or self-hosted websites..

http://arduino.clanweb.eu/wpa2-enterprise.php

MIT License

95 stars 27 forks source link

[INFO] Does not currently work for Ghent University (Belgium) because of certificate change #7

Closed redfast00 closed 2 years ago

redfast00 commented 3 years ago

Ghent University recently switched eduroam certificates and this broke eduroam for ESP8266's and ESP32's. I debugged this with esp-idf to be able to get more logs and to be able to edit the libraries and found two things:

the default mbed-tls does not behave correctly (it sends an empty EAP packet where a client certificate is expected), but I wasn't able to figure out why yet
if you disable mbed-tls in wpa_supplicant, wpa_supplicant uses its built-in TLS library (which has a lot of debug prints already, so easier to debug). This does not have support for sha384 as an algorithm for the certificate chain, so it rejects the cert (see https://github.com/espressif/esp-idf/issues/7465). I was able to "fix" this by strategically inserting return 0; in the certificate validation code, if someone doesn't do it before me, I'll open a PR to fix this properly when I have time.

martinius96 commented 2 years ago

Hello there, were you successful in solving this issue? There was example from user named debsahu: https://github.com/debsahu/Esp32_EduWiFi

redfast00 commented 2 years ago

Yes, after updating patching esp-idf, recompiling the libraries and copying them over the old Arduino libraries, I was able to fix this. From what I can see, support for those certificates has now been added to esp-idf, so this should no longer be a problem as long as your version is up to date (don't know what version of the libraries Arduino uses though)

Mitki2 commented 2 years ago

Hi @redfast00, I'm trying to get esp32 boards on the ugent eduroam without success. I'm using the most recent libraries in the arduino IDE, but maybe those are not up to date enough? how can I check this?

redfast00 commented 2 years ago

@Mitki2 The Arduino IDE might not have an up to date version of ESP IDF, I think you should be able to get the ESP-IDF version somehow. If you don't get it working and you're in Ghent, we can meet up next Friday and I'll try to help you out. Contact me via j@zeus.ugent.be if need be (in Dutch or English, either is fine).

martinius96 commented 2 years ago

I have created some updates in codes available in repository. There is 2021 and 2022 implementations. In Arduino Core 2.0.3-RC1 there was added new WiFi.begin() function that can accept parameters for WPA/WPA2 Enterprise connection. Can you please test that guys? I don't have access more to eduroam networks.

Note: 2.0.3-RC1 is development version, it is not available if you are using .json link in Arduino IDE for stable-only releases.

redfast00 commented 2 years ago

I don't really have the time to test this right now :/

martinius96 commented 1 year ago

have you tried it meantime? Was it working for you? With or without cert?

redfast00 commented 1 year ago

I haven't, but I got it working with an updated ESP-IDF, so it may have been fixed. Don't really have the time to test this anymore (I'd need to dig out my ESP boards and get the whole setup done again)