#962174 iwd: Failed to load trusted user certificate

Package:
iwd
Source:
iwd
Description:
wireless daemon for Linux
Submitter:
Date:
2022-01-26 00:51:04 UTC
Severity:
normal
Tags:
#962174#5
Date:
2020-06-04 08:29:06 UTC
From:
To:
Hello,

it looks like the IWD is not able to load trusted user certificates.
Basically if the certificate is enclosed in
-----BEGIN TRUSTED CERTIFICATE-----
-----END TRUSTED CERTIFICATE-----

I'm always getting an error "Failed to load". Once the user cert is
converted using OpenSSL and is enclosed in

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

it can be loaded without any problem. But such a converted certificate
is not accepted by the RADIUS in my case.

Below is the network configuration file and related syslog output

[Security]
EAP-Method=TLS
EAP-Identity=someuser
EAP-TLS-ClientCert=/usr/local/share/ca-certificates/user.crt
EAP-TLS-ClientKey=/usr/local/share/ca-certificates/key.crt
EAP-TLS-CACert=/usr/local/share/ca-certificates/root.crt

Jun  2 01:19:41 somehost systemd[1]: Starting Wireless service...
Jun  2 01:19:41 somehost iwd[767]: No Diffie-Hellman support found,
WPS will not be available
Jun  2 01:19:41 somehost iwd[767]: The following options are missing
in the kernel:
Jun  2 01:19:41 somehost iwd[767]: #011CONFIG_KEY_DH_OPERATIONS
Jun  2 01:19:41 somehost iwd[767]: Wireless daemon version 1.7
Jun  2 01:19:41 somehost systemd[1]: Started Wireless service.
Jun  2 01:19:41 somehost iwd[767]: netconfig: Network configuration is disabled.
Jun  2 01:19:41 somehost iwd[767]: Wiphy: 0, Name: phy0
Jun  2 01:19:41 somehost iwd[767]: #011Permanent Address: dc:a6:32:49:d4:66
Jun  2 01:19:41 somehost iwd[767]: #011Bands: 2.4 GHz 5 GHz
Jun  2 01:19:41 somehost iwd[767]: #011Ciphers: CCMP TKIP BIP
Jun  2 01:19:41 somehost iwd[767]: #011Supported iftypes: ad-hoc
station ap p2p-client p2p-go p2p-device
Jun  2 01:19:41 somehost iwd[767]: Wiphy phy0 will only use the
default interface
Jun  2 01:19:41 somehost kernel: [  169.433109] brcmfmac:
brcmf_cfg80211_set_power_mgmt: power save disabled
Jun  2 01:19:41 somehost iwd[767]: Failed to load
/usr/local/share/ca-certificates/user.crt

Thanks!
Martin
#962174#10
Date:
2020-06-19 13:59:43 UTC
From:
To:
Hello Martin Tesar,

Thanks for your bug report. This is obviously not a debian packaging
bug so could you please discuss this directly with upstream?
Either on their mailing list and/or their irc channel.

See https://sources.debian.org/src/iwd/1.8-1/debian/upstream/metadata/

Regards,
Andreas Henriksson
#962174#19
Date:
2022-01-26 00:35:45 UTC
From:
To:
Hi,

I found upstream commit 84cae48c1bfe374c8654b23ad4e766548b9203a7 which may be
related. It was first included in (upstream) version 1.12.
Can you test whether this issue still occurs with a recent version of iwd?

Please verify against the manpage of that recent iwd version whether this
configuration is still accurate or whether it needs to be updated.

This does not look like a Debian kernel, which does have the setting enabled.
May not be relevant, but mention it just in case.

Cheers,
  Diederik