I slightly changed the script I used to use for NetworkManager to also work with Connman.
- Save the script somewhere
- Download Easyroam Certificate
- Run the script with the path to the Certiifacte as argument
Repeat step 2 and 3 once Certificate needs renewal.
(The connman dbus interface needs elevated permissions, so there is a devel-su in the script and therefore the requirement to have Developer mode active and a password set)
You can also do this manually. Run the openssl commands in the script to convert the *.p12 into a bunch of .pem's and Configure the network manually. (Add network → Set “EAP method” to “TLS”, add the Certificate and key files generated previously, “Identity” is the common name in the certificate)
Script
#!/bin/sh
# easyroam.sh cert - install pkcs12 certificate as Easyroam NetworkManager Profile
helpString="Usage $0 <certificate>"
if [ $# -lt 1 ]; then
echo "$helpString" >&2
exit 1
fi
case "$1" in
-h|--help)
echo "$helpString"
exit;;
esac
ClientCertificate="$1"
connection="Easyroam"
[ -f /etc/os-release ] && source /etc/os-release
check_nmcli() {
# check for nmcli
if ! type nmcli >/dev/null 2>&1; then
echo "ERROR: nmcli not found!" >&2
echo "This wizard assumes that your network connections are managed by NetworkManager." >&2
exit 1
fi
}
check_gdbus() {
if !type gdbus >/dev/nulll 2>&1; then
echo "ERROR: gdbus not found!" >&2
echo "This wizard assumes that your network connections are managed by NetworkManager." >&2
exit 1
fi
}
cleanup_networkmanager() {
# Remove existing connections
for conn in $connection eduroam; do
for uuid in $(nmcli connection show | awk '$1==c{ print $2 }' c="$conn"); do
nmcli connection delete uuid "$uuid"
done
done
}
add_networkmanager() {
# Create new connection
nmcli connection add \
type wifi \
con-name "$connection" \
ssid "$SSID" \
-- \
wifi-sec.key-mgmt wpa-eap \
802-1x.eap tls \
802-1x.identity "$OuterIdentity" \
802-1x.ca-cert "$root_ca_file" \
802-1x.client-cert "$client_cert_file" \
802-1x.private-key-password "$Passphrase" \
802-1x.private-key "$client_key_file"
}
add_connman() {
ssid_hx=$(echo $SSID | xxd -p)
service="wifi_3c01ef794697_${ssid_hx}_managed_ieee8021x"
ca_cert=""
devel-su gdbus call --system --dest net.connman --object-path / --method net.connman.Manager.CreateService \
"" \
"" \
"" \
"[('AutoConnect', 'true'), ('CACert', '(cat $root_ca_file)'),('ClientCertFile', '$client_cert_file'),
('PrivateKeyFile', '$client_key_file'), ('PrivateKeyPassphrase', '$Passphrase'),
('EAP', 'tls'), ('Hidden', 'false'), ('Identity', '$OuterIdentity'), ('Name', 'eduroam'),
('Phase2', 'PAP'), ('Security', 'ieee8021x')]"
}
if [ $ID == "sailfishos" ]; then
check_connmanctl
else
check_gdbus
fi
# check prerequisites
for d in openssl awk; do
type "$d" >/dev/null 2>&1 && continue
echo "ERROR: $d not found!" >&2
echo >&2
echo "You may fix this using:" >&2
type apt >/dev/null 2>&1 && echo "sudo apt install -y $d" >&2
type dnf >/dev/null 2>&1 && echo "sudo dnf install -y $d" >&2
type zypper >/dev/null 2>&1 && echo "sudo zypper install $d" >&2
type pacman >/dev/null 2>&1 && echo "sudo pacman -Syu $d" >&2
type pkcon >/dev/null 2>&1 && echo "devel-su pkconf install $d" >&2
type xbps-install >/dev/null 2>&1 && echo "sudo xbps-install -Su $d" >&2
echo >&2
exit 2
done
conf_dir="$HOME/.easyroam"
client_cert_file="$conf_dir/easyroam_client_cert.pem"
client_key_file="$conf_dir/easyroam_client_key.pem"
root_ca_file="$conf_dir/easyroam_root_ca.pem"
[ -d "$conf_dir" ] || mkdir -p "$conf_dir"
openssl_extra=
version=$(openssl version | awk -F "[ .]" '{print $2}')
[ "${version:-2}" -ge 3 ] && openssl_extra="-legacy"
SSID=eduroam
OuterIdentity="$(openssl pkcs12 $openssl_extra -info -passin "pass:" -in "$ClientCertificate" -nodes 2>/dev/null | awk '/subject=CN/{print $3}' | sed -e 's/,$//g')"
Passphrase=$(openssl rand -base64 24)
printf "Extracting client cert ... "
openssl pkcs12 $openssl_extra -in "$ClientCertificate" -passin "pass:" -nokeys -out "$client_cert_file"
printf "success\n"
printf "Extracting client key ... "
openssl pkcs12 $openssl_extra -in "$ClientCertificate" -passin "pass:" -passout "pass:$Passphrase" -nodes -nocerts | \
openssl rsa -passout "pass:$Passphrase" -aes128 -out "$client_key_file"
printf "Extracting CA cert ... "
openssl pkcs12 $openssl_extra -passin "pass:" -passout "pass:" -nokeys -in "$ClientCertificate" -cacerts -out "$root_ca_file"
printf "success\n"
if [ $ID == "sailfishos" ]; then
add_connman
else
cleanup_networkmanager
add_networkmanager
fi
