From: Stefan Winter Date: Tue, 29 Jan 2019 12:26:33 +0000 (+0100) Subject: clarify which CA certs to include when using certificate_file without ca_file X-Git-Tag: release_3_0_18~37^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c9645862edd634f81fa5e50e09365edb7bf174fc;p=thirdparty%2Ffreeradius-server.git clarify which CA certs to include when using certificate_file without ca_file Sending the root serves no useful purpose; the client has this root CA installed and verifies against that trust base, or it doesn't. No amount of sending it as part of the untrusted cert data will make the root CA any more or less trusted. The previous wording was confusing for eduroam admins and consequently we see many who send a superfluous *root* certificate with their server cert. This typically costs another 1-2 roundtrips for no real purpose. The new wording is more explicit that *intermediate* CAs are a good idea, but no root. --- diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index f1b94d7d6ad..1994fc36570 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap @@ -190,10 +190,14 @@ eap { # name. # # If ca_file (below) is not used, then the - # certificate_file below MUST include not - # only the server certificate, but ALSO all - # of the CA certificates used to sign the - # server certificate. + # certificate_file below SHOULD also include + # all of the intermediate CA certificates used + # to sign the server certificate. Including the + # ROOT CA certificate is not useful and merely + # inflates the exchanged data volume during the + # TLS negotiation. + # If included, the intermediate CA certificates + # have to come AFTER the server certificate. # certificate_file = ${certdir}/server.pem