More recently, many eduroam deployments have broken on Ubuntu 22.04 LTS because they still use insecure renegotiation, which was deprecated by RFC 5746 in 2010 and for which OpenSSL dropped support for around March 2010 (along with TLS 1.0 and 1.1). Until your university fixes its network, you can re-enable insecure renegotiation by editing some config files.
The following steps were contributed to Launchpad Bug #1958267 by users "nfalse" (#22) and Simon Chopin (#36)
Step 1: Create specific openssl.cnf for wpa_supplicant
$ sudo cp /etc/ssl/openssl.cnf /etc/wpa_supplicant/
This will ensure that enabling TLS 1.0 applies only to WPA negotiations, which will mitigate the security impact of this change somewhat.
Step 2: Enable legacy TLS in the copied config file
As root, edit the new config file:
$ sudo gedit /etc/wpa_supplicant/openssl.cnf
Then, find the following lines:
[openssl_init]
providers = provider_sect
Immediately thereafter, insert the following lines:
ssl_conf = ssl_sect
[ssl_sect]
system_default = system_default_sect
[system_default_sect]
Options = UnsafeLegacyRenegotiation
CipherString = DEFAULT@SECLEVEL=1
Step 3: Make wpa_supplicant use the new configuration
As root, edit /usr/lib/systemd/system/wpa_supplicant.service
.
$ sudo gedit /usr/lib/systemd/system/wpa_supplicant.service
Find the following lines:
[Service]
Type=dbus
BusName=fi.w1.wpa_supplicant1
ExecStart=/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
ExecReload=/bin/kill -HUP $MAINPID
After BusName
, insert Environment="OPENSSL_CONF=/etc/wpa_supplicant/openssl.cnf"
. The whole section should read as follows:
[Service]
Type=dbus
BusName=fi.w1.wpa_supplicant1
Environment="OPENSSL_CONF=/etc/wpa_supplicant/openssl.cnf"
ExecStart=/sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
ExecReload=/bin/kill -HUP $MAINPID
Step 4: Restart the wpa_supplicant
You can either reboot your whole computer at this point or just run the following commands:
$ sudo systemctl daemon-reload
$ sudo systemctl restart wpa_supplicant.service