feat: issue FreeRADIUS a dedicated EAP-TLS cert from the wireless CA

FreeRADIUS now uses two certs:
- tls.crt (RadSec CA): outer RadSec TLS, verified by routers
- eap.crt (wireless CA): EAP-TLS inner auth, verified by iOS devices

iOS devices anchor EAP-TLS server trust to the wireless CA via the
mobileconfig PayloadCertificateAnchorUUID — so the EAP cert must be
issued by the wireless CA, not the RadSec CA.  This was the root cause
of the "certificate unknown" alert (sent by the device toward
FreeRADIUS when the presented cert couldn't be verified).

PINT manages the eap.crt lifecycle (load/renew on startup, 24h watcher)
identically to the existing RadSec cert.  Both certs are stored in the
same radsec-server-certificates secret.  The EAP Dogtag profile defaults
to pint_radsec_server and is overridable via PINT_IPA_EAP_CERT_PROFILE.

Author: mbillow

chart/templates/deployment.yaml

@@ -58,6 +58,10 @@ spec:
             - name: PINT_IPA_RADSEC_SERVER_CERT_PROFILE
               value: {{ .Values.config.ipaRadSecServerCertProfile | quote }}
             {{- end }}
+            {{- if .Values.config.ipaEAPCertProfile }}
+            - name: PINT_IPA_EAP_CERT_PROFILE
+              value: {{ .Values.config.ipaEAPCertProfile | quote }}
+            {{- end }}
             {{- if .Values.config.ipaSkipTLSVerify }}
             - name: PINT_IPA_SKIP_TLS_VERIFY
               value: "true"

chart/values.schema.json

@@ -73,7 +73,12 @@
         },
         "ipaRadSecServerCertProfile": {
           "type": "string",
-          "description": "Dogtag certificate profile for the FreeRADIUS server cert.",
+          "description": "Dogtag certificate profile for the FreeRADIUS outer RadSec TLS cert (RadSec CA-issued; verified by routers).",
+          "default": "pint_radsec_server"
+        },
+        "ipaEAPCertProfile": {
+          "type": "string",
+          "description": "Dogtag certificate profile for the FreeRADIUS EAP-TLS server cert (wireless CA-issued; verified by iOS devices via mobileconfig anchor).",
           "default": "pint_radsec_server"
         },
         "ipaSkipTLSVerify": {

cmd/pint/main.go

@@ -149,13 +149,19 @@ func main() {
 		pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: rootCACertDER})...,
 	)
 
-	// Load or renew FreeRADIUS server TLS cert
+	// Load or renew FreeRADIUS outer RadSec TLS cert (RadSec CA-issued; verified by routers)
 	if _, _, _, err := loadOrRenewRadSecServerCert(context.Background(), log, k8sClient, ipaClient, cfg, []byte(radSecCAChainPEM), wifiCAPEM); err != nil {
 		log.Fatal("radsec server cert failed", zap.Error(err))
 	}
 
-	// Background watcher: renew cert before expiry and reload FreeRADIUS
+	// Load or renew FreeRADIUS EAP-TLS server cert (wireless CA-issued; verified by iOS devices)
+	if err := loadOrRenewEAPServerCert(context.Background(), log, k8sClient, ipaClient, cfg); err != nil {
+		log.Fatal("eap server cert failed", zap.Error(err))
+	}
+
+	// Background watchers: renew certs before expiry and reload FreeRADIUS
 	go watchRadSecServerCert(log, k8sClient, ipaClient, cfg, []byte(radSecCAChainPEM), wifiCAPEM)
+	go watchEAPServerCert(log, k8sClient, ipaClient, cfg)
 
 	// Load or generate the SCEP RA cert (self-signed RSA, stored in K8s secret).
 	scepRACert, scepRAKey, scepRACertDER, err := loadOrGenerateSCEPRACert(context.Background(), log, k8sClient, cfg)
@@ -371,6 +377,62 @@ func watchRadSecServerCert(log *zap.Logger, k8sClient kubernetes.Interface, ipaC
 	}
 }
 
+// loadOrRenewEAPServerCert reads the EAP-TLS server cert (eap.crt/eap.key) from the RadSec
+// cert secret. If the cert is missing or within radSecRenewBefore of expiry, a new one is
+// issued from the wireless CA so that iOS devices can verify it via their mobileconfig anchor.
+func loadOrRenewEAPServerCert(ctx context.Context, log *zap.Logger, k8sClient kubernetes.Interface, ipaClient *freeipa.Client, cfg *config.Config) error {
+	secret, err := k8sClient.CoreV1().Secrets(cfg.Namespace).Get(ctx, cfg.RadSecCertSecret, metav1.GetOptions{})
+	if err == nil {
+		existing := secret.Data["eap.crt"]
+		key := secret.Data["eap.key"]
+		if len(existing) > 0 && len(key) > 0 {
+			block, _ := pem.Decode(existing)
+			if block != nil {
+				cert, parseErr := x509.ParseCertificate(block.Bytes)
+				if parseErr == nil && time.Until(cert.NotAfter) > radSecRenewBefore {
+					log.Info("reusing existing EAP server cert", zap.String("expires", cert.NotAfter.Format(time.RFC3339)))
+					return nil
+				}
+			}
+		}
+	}
+
+	privKey, csrPEM, genErr := profile.GenerateKeyAndCSR(cfg.IPAServiceHostname)
+	if genErr != nil {
+		return fmt.Errorf("generate eap key/csr: %w", genErr)
+	}
+
+	certDER, certErr := ipaClient.CertRequest(cfg.IPAPrincipal, string(csrPEM), cfg.IPAWirelessCAName, cfg.EAPCertProfile)
+	if certErr != nil {
+		return fmt.Errorf("cert_request eap: %w", certErr)
+	}
+
+	newCertPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
+	ecKeyBytes, err := x509.MarshalECPrivateKey(privKey)
+	if err != nil {
+		return fmt.Errorf("marshal eap ec key: %w", err)
+	}
+	newKeyPEM := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: ecKeyBytes})
+
+	if writeErr := radius.WriteEAPServerCert(ctx, k8sClient, cfg.Namespace, cfg.RadSecCertSecret, cfg.FreeRADIUSDeployment, newCertPEM, newKeyPEM); writeErr != nil {
+		return fmt.Errorf("write eap cert: %w", writeErr)
+	}
+	log.Info("issued and stored new EAP server cert")
+	return nil
+}
+
+// watchEAPServerCert runs forever, checking every 24 hours whether the EAP server cert
+// needs renewal. On renewal it reloads FreeRADIUS so the new cert is picked up.
+func watchEAPServerCert(log *zap.Logger, k8sClient kubernetes.Interface, ipaClient *freeipa.Client, cfg *config.Config) {
+	ticker := time.NewTicker(24 * time.Hour)
+	defer ticker.Stop()
+	for range ticker.C {
+		if err := loadOrRenewEAPServerCert(context.Background(), log, k8sClient, ipaClient, cfg); err != nil {
+			log.Error("eap cert renewal failed", zap.Error(err))
+		}
+	}
+}
+
 const profileSigningRenewBefore = 30 * 24 * time.Hour
 
 // loadOrRenewProfileSigningCert loads the profile signing cert from the K8s Secret when

dev/freeradius/eap

@@ -1,14 +1,15 @@
 # EAP-TLS module — used for WiFi user certificate authentication.
-# The server cert is shared with the RadSec listener (same FreeIPA-issued cert).
-# wifi-ca.pem is the WiFi intermediate CA; FreeRADIUS uses it to verify that
-# connecting users' EAP-TLS client certs were issued by PINT.
+# eap.crt is a separate cert issued by the wireless CA (not the RadSec CA). iOS devices
+# verify this cert using the wireless CA anchor embedded in their mobileconfig profile.
+# The outer RadSec TLS connection (tls.crt) uses a RadSec CA-issued cert verified by routers.
+# wifi-ca.pem is the WiFi CA chain; FreeRADIUS uses it to verify EAP-TLS client certs.
 eap {
     default_eap_type = tls
     timer_expire     = 60
 
     tls-config tls-csh {
-        private_key_file  = /etc/pint/radsec/tls.key
-        certificate_file  = /etc/pint/radsec/tls.crt
+        private_key_file  = /etc/pint/radsec/eap.key
+        certificate_file  = /etc/pint/radsec/eap.crt
         ca_file           = /etc/pint/radsec/wifi-ca.pem
         tls_min_version   = "1.2"
         cipher_list       = "ECDHE+AESGCM:DHE+AESGCM"

internal/config/config.go

@@ -23,7 +23,8 @@ type Config struct {
 	RootCAName              string // PINT_IPA_ROOT_CA_NAME:signing root CA; defaults to "ipa"
 	IPACertProfile          string // PINT_IPA_CERT_PROFILE:FreeIPA profile for WiFi client certs (default: pint_wifi)
 	RadSecClientCertProfile string // PINT_IPA_RADSEC_CLIENT_CERT_PROFILE:FreeIPA profile for RadSec router client certs (default: pint_radsec_client)
-	RadSecServerCertProfile string // PINT_IPA_RADSEC_SERVER_CERT_PROFILE:FreeIPA profile for FreeRADIUS server cert (default: pint_radsec_server)
+	RadSecServerCertProfile string // PINT_IPA_RADSEC_SERVER_CERT_PROFILE:FreeIPA profile for FreeRADIUS outer RadSec TLS cert (default: pint_radsec_server)
+	EAPCertProfile          string // PINT_IPA_EAP_CERT_PROFILE:FreeIPA profile for FreeRADIUS EAP-TLS server cert, issued by the wireless CA (default: pint_radsec_server)
 	IPAPrincipal            string // derived: full principal, e.g. pint/host@REALM
 	IPAServiceHostname      string // derived: hostname portion of principal, e.g. host
 	IPASkipTLSVerify        bool
@@ -114,6 +115,7 @@ func Load() (*Config, error) {
 	cfg.IPACertProfile = optional("PINT_IPA_CERT_PROFILE", "pint_wifi")
 	cfg.RadSecClientCertProfile = optional("PINT_IPA_RADSEC_CLIENT_CERT_PROFILE", "pint_radsec_client")
 	cfg.RadSecServerCertProfile = optional("PINT_IPA_RADSEC_SERVER_CERT_PROFILE", "pint_radsec_server")
+	cfg.EAPCertProfile = optional("PINT_IPA_EAP_CERT_PROFILE", "pint_radsec_server")
 	cfg.CodeSigningCAName = require("PINT_IPA_CODE_SIGNING_CA_NAME")
 	cfg.CodeSigningCertProfile = optional("PINT_IPA_CODE_SIGNING_CERT_PROFILE", "pint_profile_signing")
 	cfg.ProfileSigningCertSecret = optional("PINT_PROFILE_SIGNING_CERT_SECRET", "pint-profile-signing-cert")

internal/profile/mobileconfig.go

@@ -13,7 +13,11 @@ import (
 type MobileconfigParams struct {
 	SSID                 string
 	RadiusHost           string // hostname only, no port
-	CACertDER            []byte // wireless intermediate CA — anchors EAP-TLS server verification
+	CACertDER            []byte // wireless intermediate CA — anchors EAP-TLS server verification.
+	// FreeRADIUS presents a cert signed by the wireless CA for EAP-TLS (eap.crt in the
+	// radsec secret), so this CA is the correct anchor. The outer RadSec TLS cert (tls.crt)
+	// is signed by the RadSec CA and is verified by routers, not end devices.
+	// See: dev/freeradius/eap — certificate_file = /etc/pint/radsec/eap.crt.
 	RootCACertDER        []byte // root CA — always embed for full chain trust
 	CodeSigningCACertDER []byte // code-signing intermediate CA — embed when profile signing is enabled
 	Username             string
@@ -72,7 +76,7 @@ func BuildMobileconfig(p MobileconfigParams) ([]byte, error) {
 		"PayloadCertificateUUID": scepUUID,
 	}
 
-	// Wireless intermediate CA — anchors EAP-TLS server verification.
+	// Wireless intermediate CA — anchors EAP-TLS server verification and embedded for chain reference.
 	caPayload := map[string]interface{}{
 		"PayloadType":        "com.apple.security.root",
 		"PayloadUUID":        caUUID,

internal/radius/reload.go

@@ -46,9 +46,24 @@ func WriteRadSecTLS(ctx context.Context, k8s kubernetes.Interface, namespace, se
 	return Reload(ctx, k8s, namespace, deployment)
 }
 
+// WriteEAPServerCert writes the FreeRADIUS EAP-TLS server cert and key to the named K8s
+// Secret (eap.crt / eap.key) and triggers a FreeRADIUS rollout restart.
+// The EAP cert is issued by the wireless CA so that iOS devices can verify it using the
+// CA anchor embedded in their mobileconfig profile. This is separate from tls.crt / tls.key,
+// which is the outer RadSec TLS cert issued by the RadSec CA and verified by routers.
+func WriteEAPServerCert(ctx context.Context, k8s kubernetes.Interface, namespace, secretName, deployment string, certPEM, keyPEM []byte) error {
+	if err := patchSecretKey(ctx, k8s, namespace, secretName, "eap.crt", certPEM); err != nil {
+		return err
+	}
+	if err := patchSecretKey(ctx, k8s, namespace, secretName, "eap.key", keyPEM); err != nil {
+		return err
+	}
+	return Reload(ctx, k8s, namespace, deployment)
+}
+
 // WriteRadSecServerCert writes all FreeRADIUS TLS material to the named K8s Secret
 // and triggers a FreeRADIUS rollout restart:
-//   - tls.crt / tls.key: server cert presented to RadSec clients and EAP supplicants
+//   - tls.crt / tls.key: outer RadSec TLS cert presented to router clients (RadSec CA-issued)
 //   - ca.pem: RadSec CA chain; verifies connecting router client certificates
 //   - wifi-ca.pem: WiFi CA chain; verifies EAP-TLS user client certificates
 func WriteRadSecServerCert(ctx context.Context, k8s kubernetes.Interface, namespace, secretName, deployment string, certPEM, keyPEM, caPEM, wifiCAPEM []byte) error {