Hi there, I have a couple of CAPs connected to a CapsMan all on the latest RoS versions. CAP devices are wAPG-5HaxD2HaxD.
All works well with PSK but for one SSID I'd like to implement EAP-TLS authentication for Windows laptops. I'm already distributing certs from a Windows CA to users in the domain. Those certs include all required attributes and work well for VPN authentication (... using RRAS) and other applications that require an SSL client cert.
Anyways, user-manager seems to reject the authentication attempt with this error:
manager,debug:EAP rejected for user: <x@prod.x.com> ssl: name verification failed for: "CN=First Last"
This is the redacted content of the cert, decoded with openssl:
Certificate:
Data:
Version: 3 (0x2)
Signature Algorithm: sha256WithRSAEncryption
Issuer: DC=com, DC=x, DC=prod, CN=x-PROD-CA
Validity
Not Before: May 8 08:05:02 2025 GMT
Not After : May 8 08:05:02 2027 GMT
Subject: DC=com, DC=x, DC=prod, CN=Users, CN=First Last, emailAddress=<x@prod.x.com>
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Client Authentication, E-mail Protection, Microsoft Encrypted File System
X509v3 Key Usage: critical
Digital Signature, Key Encipherment
X509v3 Subject Alternative Name:
othername: UPN:<x@prod.x.com>, email:<x@prod.x.com>
I think the SAN is set correctly. The CN in the subject is set to "first last" but that shouldn't be a showstopper. According to docs I've read the SAN is used by user-manager to match the username.
Anyways, has anybody else seen similar issues? The Mikrotik EAP-TLS config is very basic, as documented in this article: Enterprise wireless security with User Manager v5 - RouterOS - MikroTik Documentation
Now... it there a way to configure user-manager in terms of which attributes should be used for the name verification? Or any other workaround that doesn't involve re-issuing certificates?
P.S: If I point the RADIUS client of the CAPSMan to a Windows NPS server, all works perfectly well. I just prefer not having to rely on the NPS to be up and running for WIFI authentication purposes....