With the conceptual differences being small, a number of secondary factors come into play when making the decision where to get a server certificate from: In that light, it does not make much difference whether to procure a server certificate from a commercial CA or to make your own either way, configuration steps are necessary on the end-user device to enable and secure your chosen setup. Especially for commercial CAs, keep in mind that if you ever want to switch to a different CA as a trust anchor, all your end-user devices again need to be re-configured for that new root.Ĭonfiguration tools like eduroam CAT enable to provision the chosen CA(s) and the expected server name(s) into client devices without user interaction. For your own private-use CA: choose a very long expiry date for the CA. As a consequence: for commercial CAs, check their root CA's expiry date so you can make an informed decision whether you want to buy the certificate from them or not.

Both for commercial and private CAs please be aware that an exchange of the root CA certificate will require re-configuration of all your end-users' devices to accept the new CA. Note that also root CA certificates have an expiry date. For a commercial CA, the installation of the actual CA file may be superfluous in some client operating systems (particularly those who make their 'web browser' trust store also accessible for EAP purposes), but marking that particular CA as trusted for this specific EAP authentication setup still needs to be done. A trust store list from the web browser is thus insignificant in this context certificates from a commercial CA are as valid for EAP authentications as are self-made certificates or certificates from a small, special-purpose CA. Here, the end user device is pre-provisioned with the entire set of information it needs to verify this specific TLS connection: the IdP has a certificate from exactly one CA, and needs to communicate both that CA and the name of his authentication server to the end user. These considerations are not at all true in an EAP authentication context, such as an eduroam login. In an abstract notion, one can say: it is required to have many CAs in the list because the user device does not have all required information for certificate validation contained in its own setup it misses the information 'which CA did the server I am browsing to use to certify the genuinity of his website?'. It makes sense for browsers to have a pre-configured trust store with many well-known CAs because the user may browse to any website and the operator of that website may have chosen any of those well-known CAs for his website.

In a generic web server context, server certificates are usually required to be procured by a commercial Certification Authority (CA) operator self-made certificates trigger an 'Untrusted Certificate' warning. Almost all EAP types in eduroam (with the exception of EAP-PWD) require an X.509 server certificate with which the RADIUS server identifies itself to the end user before the user sends his credentials to the server.

Macos server certificates