Add Key Identifier extensions to server.cnf

The Intel Wireless Daemon (iwd, alternative to wpa_supplicant) heavily
relies on Linux kernel interfaces for all its crypto, but the Linux
kernel doesn't seem to accept certificates without these extensions and
hence TLS will fail without them.

diff --git a/raddb/certs/server.cnf b/raddb/certs/server.cnf
index 2d7a05af452aec3fff085448cb5b03b887dd1a18..0c158fce23a7496f85cef48c0f099fe71f31a25e 100644 (file)
--- a/raddb/certs/server.cnf
+++ b/raddb/certs/server.cnf
@@ -56,6 +56,8 @@ emailAddress          = admin@example.org
 commonName             = "Example Server Certificate"
 
 [ v3_radius ]
+subjectKeyIdentifier   = hash
+authorityKeyIdentifier = keyid:always,issuer:always
 basicConstraints       = CA:FALSE
 keyUsage               = nonRepudiation, digitalSignature, keyEncipherment