Comment 2 for bug 1575614

Revision history for this message
Arkady (arkann1985) wrote : Re: Can't select secret key for TLS auth on wired connection

Hello Ervin,

Sure. Here are the steps I used to configure wired connection:
1. place your certificate, CA certificate and secret key files in some directory (in my case it is ~/.certs)
2. create file /etc/wpa_supplicant/wired.conf using sudo with the following content:

ctrl_interface=/var/run/wpa_supplicant
eapol_version=1
ap_scan=0
network={
eapol_flags=0
key_mgmt=IEEE8021X
eap=TLS
identity="<username>@<domain>"
ca_cert="/home/<user>/.certs/<ca_cert>.pem"
client_cert="/home/<user>/.certs/<certificate>.crt"
private_key="/home/<user>/.certs/<private_key>.pem"
private_key_passwd="<password>"
}

3. test wpa_supplicant with the following commands:
sudo wpa_supplicant -c /etc/wpa_supplicant/wired.conf -i eth<N> -B -D wired
sudo dhclient eth<n>

If internet now works then proceed to the next step

4. add the following lines to file /etc/network/interfaces
auto eth<N>
iface eth<N> inet dhcp
    pre-up wpa_supplicant -c/etc/wpa_supplicant/wired.conf -ieth<N> -D wired -B > /var/log/ifup_wpa1.log 2> /var/log/ifup_wpa2.log

For wireless network wpa_supplicant config file should be like:

ctrl_interface=/var/run/wpa_supplicant
        ctrl_interface_group=0
        eapol_version=1
        ap_scan=1
        fast_reauth=1
network={
        ssid="<network_ssid>"
        scan_ssid=1
        key_mgmt=WPA-EAP
        proto=WPA2
        pairwise=CCMP
        group=CCMP
        eap=TLS
        identity="<username>@<domain>"
        ca_cert="/home/<user>/.certs/<ca_cert>.pem"
        client_cert="/home/<user>/.certs/<certificate>.crt"
        private_key="/home/<user>/.certs/<private_key>.pem"
        private_key_passwd="<password>"
        priority=1
        }