Horizon Wi-Free is an 802.1x authenticated network service intended to allow UPC customers to use WiFi Offload via UPC broadband routers. Essentially almost all UPC modems are broadcasting a “Horizon Wi-Free” SSID, and authenticating via 802.1x in the backend.
Note: You cannot connect to Horizon Wi-Free through your own router, so you will have to test against another customer’s one! I believe the idea behind this is to prevent you using the ‘roaming’ network while at home.
Configuring wpa_supplicant.conf
Main points here are:
- SSID: this should be “Horizon Wi-Free”
- parwise and group = CCMP
- EAP: This needs to be PEAP as a username and password are required
- identity: this is your UPC Wi-Free username
- password: the Wi-Free password, not your web account password
- ca_cert: This cert is to verify that we are actually connecting to a network belonging to UPC (see below)
- phase2: This must be MSCHAPV2
network={
ssid="Horizon Wi-Free"
key_mgmt=WPA-EAP
pairwise=CCMP
group=CCMP
eap=PEAP
identity="username"
password="my_secret_password"
ca_cert="/etc/cert/liberty_global.pem"
phase1="peapver=0"
phase2="MSCHAPV2"
id_str="horizon-free-wifi"
}
Getting the CA Cert for Network Verification
This step was a little more work then expected, as I had to track down a copy of the CA cert. The easiest way is to download the .mobileconfig file intended for iOS and extract the required cert chain:
wget http://www.upc.ie/horizonwifreedevicesetup/applesecurity/
[user.local][~/Downloads]=> openssl pkcs7 -inform DER -print_certs -in ./HorizonWi-Freev1.mobileconfig
subject=/O=AlphaSSL/CN=AlphaSSL CA - G2
issuer=/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
-----BEGIN CERTIFICATE-----
MIIELzCCAxegAwIBAgILBAAAAAABL07hNwIwDQYJKoZIhvcNAQEFBQAwVzELMAkG
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw0xMTA0MTMxMDAw
MDBaFw0yMjA0MTMxMDAwMDBaMC4xETAPBgNVBAoTCEFscGhhU1NMMRkwFwYDVQQD
ExBBbHBoYVNTTCBDQSAtIEcyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAw/BliN8b3caChy/JC7pUxmM/RnWsSxQfmHKLHBD/CalSbi9l32WEP1+Bstjx
T9fwWrvJr9Ax3SZGKpme2KmjtrgHxMlx95WE79LqH1Sg5b7kQSFWMRBkfR5jjpxx
XDygLt5n3MiaIPB1yLC2J4Hrlw3uIkWlwi80J+zgWRJRsx4F5Tgg0mlZelkXvhpL
OQgSeTObZGj+WIHdiAxqulm0ryRPYeDK/Bda0jxyq6dMt7nqLeP0P5miTcgdWPh/
UzWO1yKIt2F2CBMTaWawV1kTMQpwgiuT1/biQBXQHQFyxxNYalrsGYkWPODIjYYq
+jfwNTLd7OX+gI73BWe0i0J1NQIDAQABo4IBIzCCAR8wDgYDVR0PAQH/BAQDAgEG
MBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFBTqGVXwDg0yxh90M7eOZhpM
EjEeMEUGA1UdIAQ+MDwwOgYEVR0gADAyMDAGCCsGAQUFBwIBFiRodHRwczovL3d3
dy5hbHBoYXNzbC5jb20vcmVwb3NpdG9yeS8wMwYDVR0fBCwwKjAooCagJIYiaHR0
cDovL2NybC5nbG9iYWxzaWduLm5ldC9yb290LmNybDA9BggrBgEFBQcBAQQxMC8w
LQYIKwYBBQUHMAGGIWh0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL3Jvb3RyMTAf
BgNVHSMEGDAWgBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0BAQUFAAOC
AQEABjBCm89JAn6J6fWDWj0C87yyRt5KUO65mpBz2qBcJsqCrA6ts5T6KC6y5kk/
UHcOlS9o82U8nxTyaGCStvwEDfakGKFpYA3jnWhbvJ4LOFmNIdoj+pmKCbkfpy61
VWxH50Hs5uJ/r1VEOeCsdO5l0/qrUUgw8T53be3kD0CY7kd/jbZYJ82Sb2AjzAKb
WSh4olGd0Eqc5ZNemI/L7z/K/uCvpMlbbkBYpZItvV1lVcW/fARB2aS1gOmUYAIQ
OGoICNdTHC2Tr8kTe9RsxDrE+4CsuzpOVHrNTrM+7fH8EU6f9fMUvLmxMc72qi+l
+MPpZqmyIJ3E+LgDYqeF0RhjWw==
-----END CERTIFICATE-----
subject=/OU=Domain Control Validated/CN=*.upcbroadband.com
issuer=/O=AlphaSSL/CN=AlphaSSL CA - G2
-----BEGIN CERTIFICATE-----
MIIEtzCCA5+gAwIBAgISESEulCUW/1LPLh5Wj7dtRUYSMA0GCSqGSIb3DQEBBQUA
MC4xETAPBgNVBAoTCEFscGhhU1NMMRkwFwYDVQQDExBBbHBoYVNTTCBDQSAtIEcy
MB4XDTEzMDExNjEyMzY0M1oXDTE1MDExNzEyMzY0M1owQDEhMB8GA1UECxMYRG9t
YWluIENvbnRyb2wgVmFsaWRhdGVkMRswGQYDVQQDDBIqLnVwY2Jyb2FkYmFuZC5j
b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCh0AMi+hy7flw92BCL
dXuXeFVFGSE9nXnzhspXIPVTkMMGHfZrkbxw3DzTrLD490X3o3UcQ8gxwU80jf7I
71wpxaXLdUxAFk2IpgSb6hAtOiBGtioTx8/5ZxlGW+c1JPb6ompslyY4fe4f9y3k
9u6cIKAzttnTNLCOe1IUIfy1HjjDm3/lzVuuV4N7eu/bYtPE6RB8xpm/3lK2cRCB
T8ueRokeU3Wiq3mZSKenT54rw+3kWBFfAAKVjyNHctQHlrtzSal28JQJ/tVLhhOM
sDO0kss0y+U0wbzjc/sfjBHDaNxboTc4C9MwzEScNrn9WH8qj/xT+nHTFBITiqSh
1EF5AgMBAAGjggG7MIIBtzAOBgNVHQ8BAf8EBAMCBaAwTQYDVR0gBEYwRDBCBgor
BgEEAaAyAQoKMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24u
Y29tL3JlcG9zaXRvcnkvMC8GA1UdEQQoMCaCEioudXBjYnJvYWRiYW5kLmNvbYIQ
dXBjYnJvYWRiYW5kLmNvbTAJBgNVHRMEAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMB
BggrBgEFBQcDAjA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3JsMi5hbHBoYXNz
bC5jb20vZ3MvZ3NhbHBoYWcyLmNybDB/BggrBgEFBQcBAQRzMHEwPAYIKwYBBQUH
MAKGMGh0dHA6Ly9zZWN1cmUyLmFscGhhc3NsLmNvbS9jYWNlcnQvZ3NhbHBoYWcy
LmNydDAxBggrBgEFBQcwAYYlaHR0cDovL29jc3AyLmdsb2JhbHNpZ24uY29tL2dz
YWxwaGFnMjAdBgNVHQ4EFgQUidh6RCyiMnWkZqNJ+NrOP9APjIswHwYDVR0jBBgw
FoAUFOoZVfAODTLGH3Qzt45mGkwSMR4wDQYJKoZIhvcNAQEFBQADggEBABMneGO7
KOzZ7pEB4NN9rHDizfz+3fauF68WQz9V3+byP53mwZWgfpX80nxi1uD3qGzgaNUB
mgenNxrsvziw1aiDAgMiwc+uhN8BYh/cezfp+pe2qBnyeu2CJBQ9tLIyyBp7cCl3
PGNSBhXr4xBxsfVV+4xqk7aLkG9aVelPIrQWokwPZ5VWBxjSAmrWipvPRfzb7IeA
DVM9W1ZhxyDY1D7d6F56Q0WTTNAsV/nWv9sNOlkME9lpF4ytpvxNHLHgO7cKvgr/
lTZMhfRdQB9Djn3OJ22O5AratklkkxJquvIAOYHvg6GEhWk+IFbg2Lkrn6tuPwB5
W24J6nCgFx/jzvc=
-----END CERTIFICATE-----
Throw these into a file and get openssl to verify:
[user@machine][~]=> openssl verify liberty_global.pem
liberty_global.pem: OK
While the theory behind this is sound, unfortunately there was an issue when I attempted to test the connection:
SSL: SSL_connect:SSLv3 read server hello A
TLS: Certificate verification failed, error 19 (self signed certificate in certificate chain) depth 2 for '/C=NL/O=Liberty Global Operations B.V./OU=Root CA0001/CN=Liberty Global Root Certification Authority'
wlan1: CTRL-EVENT-EAP-TLS-CERT-ERROR reason=1 depth=2 subject='/C=NL/O=Liberty Global Operations B.V./OU=Root CA0001/CN=Liberty Global Root Certification Authority' err='self signed certificate in certificate chain'
SSL: (where=0x4008 ret=0x230)
SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA
SSL: (where=0x1002 ret=0xffffffff)
SSL: SSL_connect:error in SSLv3 read server certificate B
OpenSSL: openssl_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
SSL: 7 bytes pending from ssl_out
SSL: Failed - tls_out available to report error
SSL: 7 bytes left to be sent out (of total 7 bytes)
Apparently OpenSSL blows a fuse when pointed at the CA cert, as it seemingly tries to authenticate the CA cert against a higher authority – since this is a root cert that is not possible. Apparently I’m not the first to see this little problem.
Quick workaround is to disable the CA Cert setting in the wpa_supplicants file and we are in business:
SSL: SSL_connect:SSLv3 read server hello A
TLS: tls_verify_cb - preverify_ok=1 err=19 (self signed certificate in certificate chain) ca_cert_verify=0 depth=2 buf='/C=NL/O=Liberty Global Operations B.V./OU=Root CA0001/CN=Liberty Global Root Certification Authority'
wlan1: CTRL-EVENT-EAP-PEER-CERT depth=2 subject='/C=NL/O=Liberty Global Operations B.V./OU=Root CA0001/CN=Liberty Global Root Certification Authority'
TLS: tls_verify_cb - preverify_ok=1 err=19 (self signed certificate in certificate chain) ca_cert_verify=0 depth=2 buf='/C=NL/O=Liberty Global Operations B.V./OU=Root CA0001/CN=Liberty Global Root Certification Authority'
wlan1: CTRL-EVENT-EAP-PEER-CERT depth=2 subject='/C=NL/O=Liberty Global Operations B.V./OU=Root CA0001/CN=Liberty Global Root Certification Authority'
TLS: tls_verify_cb - preverify_ok=1 err=19 (self signed certificate in certificate chain) ca_cert_verify=0 depth=1 buf='/C=NL/O=Liberty Global Operations B.V./OU=HORIZON Service Operator CA0001/CN=Liberty Global HORIZON Service Operator Certification Authority'
wlan1: CTRL-EVENT-EAP-PEER-CERT depth=1 subject='/C=NL/O=Liberty Global Operations B.V./OU=HORIZON Service Operator CA0001/CN=Liberty Global HORIZON Service Operator Certification Authority'
TLS: tls_verify_cb - preverify_ok=1 err=19 (self signed certificate in certificate chain) ca_cert_verify=0 depth=0 buf='/CN=Liberty Global WiFi/OU=HORIZON/O=Liberty Global Operations B.V./C=NL'
wlan1: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=Liberty Global WiFi/OU=HORIZON/O=Liberty Global Operations B.V./C=NL'
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3 read server certificate A
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3 read server done A
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3 write client key exchange A
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3 write change cipher spec A
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3 write finished A
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3 flush data
SSL: (where=0x1002 ret=0xffffffff)
SSL: SSL_connect:error in SSLv3 read finished A
SSL: SSL_connect - want more data
SSL: 318 bytes pending from ssl_out
SSL: 318 bytes left to be sent out (of total 318 bytes)
EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
TX EAPOL: dst=54:88:0e:b8:5d:79
TX EAPOL - hexdump(len=332): 01 00 01 48 02 07 01 48 19 80 00 00 01 3e 16 03 01 01 06 10 00 01 02 01 00 75 1a fa 59 f4 52 82 d3 c2 c4 da 8e 12 6b 25 ab bd 77 93 3c a4 0f bb a0 34 bf f9 63 d0 4c 8a 2d 5d 71 11 24 a6 33 71 8e 8f b9 87 36 18 21 b8 c0 09 11 3a 59 6a 6a 77 65 b3 75 69 24 75 8f be ef 2b 07 2c 20 78 89 84 6e 54 dd f0 34 80 d8 39 cf 6b 5c 10 cb cf 99 90 d5 12 7f 5d 08 17 49 79 28 d1 23 11 c5 dc 2f a7 19 2c e2 c4 5d 4b 35 18 93 dc c5 e9 6d 82 40 ff 13 a6 19 79 dd fb c6 20 e6 0a 02 4f 24 90 3b 5c ea 6a 1b 80 16 85 9e ab 04 51 b4 ac dd dd a5 59 b1 84 12 89 65 a9 64 82 f7 7f f2 6c 48 5d 0f e7 7d c8 5b 60 ee 8a 41 98 55 4e c2 92 55 8e b1 0a dd 55 d5 4f 7b 2d 0a 4a 8b df 1a e1 cf 12 0d cd c5 3e 45 18 e9 69 cb 96 5a 9e 69 cd 4d 72 63 07 ab ab c0 c4 a1 04 e1 2f ad 12 a9 c9 82 9c 1b fe 8e a1 d7 48 6c 6e dd 90 08 5d 8a 5f 0b 54 eb b0 4e e8 17 04 45 64 2e 67 6d 14 03 01 00 01 01 16 03 01 00 28 11 ea 76 36 ea 35 2f 95 eb f3 ff 22 9e 41 31 17 08 f9 e5 53 48 b1 96 c9 f7 6d a3 9b 25 f7 7a cb b3 a9 5d 8f f2 9e 9e 02
EAPOL: SUPP_BE entering state RECEIVE
wlan1: RX EAPOL from 54:88:0e:b8:5d:79
RX EAPOL - hexdump(len=63): 01 00 00 39 01 08 00 39 19 00 14 03 01 00 01 01 16 03 01 00 28 03 7e 2e d8 7e ce 49 a8 3e 53 d3 90 47 40 b3 c7 00 f2 00 7d d0 23 ae ba 9a 27 2d cd aa 0b 7f 68 52 48 f6 4a 58 f6 11 89 00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request id=8 method=25 vendor=0 vendorMethod=0
EAP: EAP entering state METHOD
SSL: Received packet(len=57) - Flags 0x00
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3 read finished A
SSL: (where=0x20 ret=0x1)
SSL: (where=0x1002 ret=0x1)
SSL: 0 bytes pending from ssl_out
SSL: No Application Data included
SSL: No data to be sent out
EAP-PEAP: TLS done, proceed to Phase 2
EAP-PEAP: using label 'client EAP encryption' in key derivation
EAP-PEAP: Derived key - hexdump(len=64): [REMOVED]
SSL: Building ACK (type=25 id=8 ver=0)
EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
TX EAPOL: dst=54:88:0e:b8:5d:79
TX EAPOL - hexdump(len=10): 01 00 00 06 02 08 00 06 19 00
EAPOL: SUPP_BE entering state RECEIVE
wlan1: RX EAPOL from 54:88:0e:b8:5d:79
RX EAPOL - hexdump(len=41): 01 00 00 23 01 09 00 23 19 00 17 03 01 00 18 ee f5 c3 a9 be 73 08 05 92 fd e0 52 73 8b 2a 53 a5 d9 64 8d cc 3c 20 f6 00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request id=9 method=25 vendor=0 vendorMethod=0
EAP: EAP entering state METHOD
SSL: Received packet(len=35) - Flags 0x00
EAP-PEAP: received 29 bytes encrypted data for Phase 2
EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=1): 01
EAP-PEAP: received Phase 2: code=1 identifier=9 length=5
EAP-PEAP: Phase 2 Request: type=1
EAP: using real identity - hexdump_ascii(len=8):
63 6f 6c 69 6e 6d 61 63 colinmac
EAP-PEAP: Encrypting Phase 2 data - hexdump(len=13): [REMOVED]
SSL: 66 bytes left to be sent out (of total 66 bytes)
EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
TX EAPOL: dst=54:88:0e:b8:5d:79
TX EAPOL - hexdump(len=76): 01 00 00 48 02 09 00 48 19 00 17 03 01 00 18 0c 6d 84 e3 05 5a ed 21 51 24 0a f4 f3 c6 c7 49 df 39 c5 27 ad 3e cd 8d 17 03 01 00 20 46 a2 79 7f 71 23 e0 91 8a b0 24 11 c8 0f 48 44 09 78 ba ec 81 29 c8 dd 61 9e f1 42 87 92 ec b1
EAPOL: SUPP_BE entering state RECEIVE
EAPOL: startWhen --> 0
wlan1: RX EAPOL from 54:88:0e:b8:5d:79
RX EAPOL - hexdump(len=65): 01 00 00 3b 01 0a 00 3b 19 00 17 03 01 00 30 26 88 61 ea ad c4 b0 dd 63 c9 18 29 ee 80 d1 0a 69 ab f4 b1 e9 2a 1e 26 26 37 22 4c 2e 3a 4a 15 43 43 62 3f 11 f9 4e df a3 f3 a8 d2 c4 71 68 bc 00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request id=10 method=25 vendor=0 vendorMethod=0
EAP: EAP entering state METHOD
SSL: Received packet(len=59) - Flags 0x00
EAP-PEAP: received 53 bytes encrypted data for Phase 2
EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=25): 1a 01 0a 00 18 10 ef 8b 8c 7b 1e 81 00 f8 0c c9 af 89 fd f6 2e 38 46 45 31
EAP-PEAP: received Phase 2: code=1 identifier=10 length=29
EAP-PEAP: Phase 2 Request: type=26
EAP-PEAP: Selected Phase 2 EAP vendor 0 method 26
EAP-MSCHAPV2: RX identifier 10 mschapv2_id 10
EAP-MSCHAPV2: Received challenge
EAP-MSCHAPV2: Authentication Servername - hexdump_ascii(len=3):
46 45 31 FE1
EAP-MSCHAPV2: Generating Challenge Response
Get randomness: len=16 entropy=21
MSCHAPV2: Identity - hexdump_ascii(len=8):
63 6f 6c 69 6e 6d 61 63 colinmac
MSCHAPV2: Username - hexdump_ascii(len=8):
63 6f 6c 69 6e 6d 61 63 colinmac
MSCHAPV2: auth_challenge - hexdump(len=16): ef 8b 8c 7b 1e 81 00 f8 0c c9 af 89 fd f6 2e 38
MSCHAPV2: peer_challenge - hexdump(len=16): 67 d4 8e 8e e8 48 22 57 9d be b7 2e 73 83 49 44
MSCHAPV2: username - hexdump_ascii(len=8):
63 6f 6c 69 6e 6d 61 63 colinmac
MSCHAPV2: password - hexdump_ascii(len=16): [REMOVED]
MSCHAPV2: NT Response - hexdump(len=24): 10 79 02 a5 f2 bf eb 3e 3a 61 f8 2f 8d 32 35 56 4e 35 78 61 8a ef f7 95
MSCHAPV2: Auth Response - hexdump(len=20): 32 2c 46 ee 9d 2d c6 75 34 e7 df ca fa 35 2b 76 8a 5a 42 d9
MSCHAPV2: Master Key - hexdump(len=16): [REMOVED]
EAP-MSCHAPV2: TX identifier 10 mschapv2_id 10 (response)
EAP-PEAP: Encrypting Phase 2 data - hexdump(len=67): [REMOVED]
SSL: 122 bytes left to be sent out (of total 122 bytes)
EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
TX EAPOL: dst=54:88:0e:b8:5d:79
TX EAPOL - hexdump(len=132): 01 00 00 80 02 0a 00 80 19 00 17 03 01 00 18 55 ca 7a 1f a1 5d 3a 0a fc 0d db 15 36 2c 6b af 4b 79 39 4c 40 45 62 83 17 03 01 00 58 c1 08 63 3f a0 5e 42 9a 7f 41 9f bf a3 c7 ae 76 50 17 67 6e 94 ea 41 d8 91 70 04 90 b2 8d dd 8d 18 7f 4b f5 67 7a 4f 1a b3 da 86 4d 24 b6 bf 87 ac 0b 31 05 56 39 2e ec 7a 67 65 8f 3a 99 6c 6e d1 53 02 49 02 d6 19 20 cf 19 33 6a c1 05 5e 75 76 b7 c0 e2 dc fb 49 04
EAPOL: SUPP_BE entering state RECEIVE
wlan1: RX EAPOL from 54:88:0e:b8:5d:79
RX EAPOL - hexdump(len=89): 01 00 00 53 01 0b 00 53 19 00 17 03 01 00 48 6b ee 0f 37 d5 50 c5 65 30 01 05 78 12 a5 e5 e1 81 80 dd c4 ee 6c f3 d6 7c ab fd 1b 92 42 5c 8b fb 5d 8d 0d 2f 7b 82 86 2b 72 71 f8 8d 91 ae ef e0 4a d2 17 d1 c4 4b e2 6d 36 ae d2 fd 88 a7 96 b8 45 b5 69 e4 54 5f 12 00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request id=11 method=25 vendor=0 vendorMethod=0
EAP: EAP entering state METHOD
SSL: Received packet(len=83) - Flags 0x00
EAP-PEAP: received 77 bytes encrypted data for Phase 2
EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=47): 1a 03 0a 00 2e 53 3d 33 32 32 43 34 36 45 45 39 44 32 44 43 36 37 35 33 34 45 37 44 46 43 41 46 41 33 35 32 42 37 36 38 41 35 41 34 32 44 39
EAP-PEAP: received Phase 2: code=1 identifier=11 length=51
EAP-PEAP: Phase 2 Request: type=26
EAP-MSCHAPV2: RX identifier 11 mschapv2_id 10
EAP-MSCHAPV2: Received success
EAP-MSCHAPV2: Success message - hexdump_ascii(len=0):
EAP-MSCHAPV2: Authentication succeeded
EAP-PEAP: Encrypting Phase 2 data - hexdump(len=6): [REMOVED]
SSL: 58 bytes left to be sent out (of total 58 bytes)
EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
TX EAPOL: dst=54:88:0e:b8:5d:79
TX EAPOL - hexdump(len=68): 01 00 00 40 02 0b 00 40 19 00 17 03 01 00 18 39 d5 bf 6d ab 16 a3 06 c3 c3 25 b2 73 e5 67 a7 67 d9 d7 aa a8 8e 23 51 17 03 01 00 18 79 03 52 49 f6 02 7e 4d a5 7f 9d 2c 1b b5 29 b5 aa 31 8a 1e 5b ed a5 d9
EAPOL: SUPP_BE entering state RECEIVE
wlan1: RX EAPOL from 54:88:0e:b8:5d:79
RX EAPOL - hexdump(len=49): 01 00 00 2b 01 0c 00 2b 19 00 17 03 01 00 20 13 ba 7a c4 11 66 26 d0 30 0c 03 18 f1 b7 de 1e 21 22 6e 19 0a ff e9 46 de 42 dc bf d7 81 11 24 00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request id=12 method=25 vendor=0 vendorMethod=0
EAP: EAP entering state METHOD
SSL: Received packet(len=43) - Flags 0x00
EAP-PEAP: received 37 bytes encrypted data for Phase 2
EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=11): 01 0c 00 0b 21 80 03 00 02 00 01
EAP-PEAP: received Phase 2: code=1 identifier=12 length=11
EAP-PEAP: Phase 2 Request: type=33
EAP-TLV: Received TLVs - hexdump(len=6): 80 03 00 02 00 01
EAP-TLV: Result TLV - hexdump(len=2): 00 01
EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed
EAP-PEAP: Encrypting Phase 2 data - hexdump(len=11): [REMOVED]
SSL: 66 bytes left to be sent out (of total 66 bytes)
EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
TX EAPOL: dst=54:88:0e:b8:5d:79
TX EAPOL - hexdump(len=76): 01 00 00 48 02 0c 00 48 19 00 17 03 01 00 18 73 64 46 7d 38 e3 b0 07 de 23 4c 48 10 ac 96 c0 39 23 61 d5 34 03 14 af 17 03 01 00 20 01 9c d7 1c 26 ff f6 77 cf c0 d5 42 f3 56 b4 d0 9d b5 09 d5 77 b2 37 dc 40 41 c5 4c 09 fa 0c 4f
EAPOL: SUPP_BE entering state RECEIVE
wlan1: RX EAPOL from 54:88:0e:b8:5d:79
RX EAPOL - hexdump(len=10): 01 00 00 04 03 0c 00 04 00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Success
EAP: EAP entering state SUCCESS
wlan1: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
Otherwise, the proper way is to install the cert into the system
But to keep everything up and running in the meantime I decided to use memmap to block off that chunk of memory while linux is booting. To do this modify /etc/default/grub:
