From: Emil Renner Berthing <esmil@mailme.dk>
Date: Mon, 11 Jan 2021 19:22:37 +0000 (+0100)
Subject: Add Key Identifier extensions to server.cnf
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d9e7106b3a7b406c4b2be43fc95f02608803555f;p=thirdparty%2Ffreeradius-server.git

Add Key Identifier extensions to server.cnf

The Intel Wireless Daemon (iwd, alternative to wpa_supplicant) heavily
relies on Linux kernel interfaces for all its crypto, but the Linux
kernel doesn't seem to accept certificates without these extensions and
hence TLS will fail without them.
---

diff --git a/raddb/certs/server.cnf b/raddb/certs/server.cnf
index 2d7a05af452..0c158fce23a 100644
--- a/raddb/certs/server.cnf
+++ b/raddb/certs/server.cnf
@@ -56,6 +56,8 @@ emailAddress		= admin@example.org
 commonName		= "Example Server Certificate"
 
 [ v3_radius ]
+subjectKeyIdentifier	= hash
+authorityKeyIdentifier	= keyid:always,issuer:always
 basicConstraints	= CA:FALSE
 keyUsage		= nonRepudiation, digitalSignature, keyEncipherment