Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

How to make Macintosh to work for EAP-TLS

Windows client authenticating fine but the for EAP-TLS/Machine authentication but the Macintosh client does not.

Background:
The issue is due to the Windows client prepends a "host/" in front of the name on the certificate and the Macintosh client does not.

Macintosh client in failed authentication log on ACS.:
02/16/2011  07:28:53  Authen failed  xyz.domain.com Default Group  External user not found

Windows Client:
02/17/2011  07:29:52  Authen OK  host/xyz.domain.com Network-Switch.

How to configure MAC OS to work using EAP TLS.
To make it work Cert should have,

The CN  as host/computername@domainname
The SAN as DNS=computername@domainname

The two names have to be different as shown above. To make this work we need the CN=host/ and the SAN name without the host/.

If we just used the existing ‘machine’ template in the Microsoft CA server, and changed the CN name we will not get any SAN name at all.

--> By default, a CA that is configured on a Windows Server 2003-based computer does not issue certificates that contain the SAN extension. If SAN entries are included in the certificate request, these entries are omitted from the issued certificate.

To get the SAN attribute in the certificate, on the Cert we need to run the following commands at a command prompt on the server that runs the Certification Authority service.

Press ENTER after each command.

certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc
net start certsvc”

--> Then generate and import a certificate that had the correct names.
--> Set up the ACS to use the SAN name as for the comparison and the “outer identity” as the username.


Reference Doc

http://support.microsoft.com/kb/931351

Regards,

~JG

Version history
Revision #:
1 of 1
Last update:
‎03-02-2011 02:42 PM
Updated by:
 
Labels (1)
Comments
New Member

I realize I'm posting on a 5 year old thread, but this is the only thing I've come across that meets my needs.

It makes sense to me that the CN on the cert must have host/ in it, but how do I configure the CA to hand out a cert with that string prefixing the rest of it?

Is this something that I have to do in Active Directory, or maybe when I Bind the Mac to AD?