...
Managing accredited CAs in eduroam servers
As at May 2020, this section may be outdated. The TACAR list of eduPKI eduroam certificates does not include the eduPKI CA certificate described below and does include a certificate that is not widely accepted. There are planned changes that may result in this process being entirely revised. However, in the mean time, use of TACAR will lead to FetchCRL3 errors and including the eduPKI CA certificate manually is required for a functioning eduroam RadSec implementation.
The number of accredited CAs and the list of certificates can change at any time. It is important that all eduroam servers consult an up-to-date list of accredited CAs. The list of currently accredited CAs is maintained in a TERENA repository of the TACAR service. A browsable list can be found here: https://www.tacar.org/cert/list/
...
- place the .info files of all accredited CAs into one otherwise empty directory ( download edupki.info ) - let's assume for this example that the path to those files is
/path/to/certificates/
- find out the command which restarts your RADIUS server on your system - let's assume for this example that the command is
systemctl restart radiusd.service
- The following command will attempt to fetch an up-to-date CRL for the CA, and only if successful, will restart your server:
fetch-crl -l /path/to/certificates/ && systemctl restart radiusd.service
This script should be executed in a cron job on a regular basis (we suggest daily).
...