eduroam Network Installation

Getting eduroam to work on Linux is more painful than it should be. Every “official” method I tried failed; the connection would just hang during the TLS handshake and never connect. I eventually figured out a manual setup that works reliably and wrote a script around it. Sharing it here so you hopefully don’t have to go through the same process.

What doesn’t work

What does work

PEAP/MSCHAPv2 validated against Saxion’s own certificate authority, pinned inside the script, plus domain-suffix-match (the modern replacement for the deprecated altsubject-matches).

The script used to point at the system trust store, which meant any of the roughly 150 public CAs your distribution ships could vouch for a server calling itself ise.infra.saxion.net. It now trusts four HARICA roots and nothing else:

The RSA pair is what the server serves today, and both members of it are pinned for a reason. The server currently chains through the cross-signed 2021 root up to the 2015 root, but HARICA publishes that cross certificate as valid only until 2029-08-31. After that date the chain has to terminate at the self-signed 2021 root, which is already pinned here and already what OpenSSL terminates on today.

The ECC pair covers a move off RSA. HARICA’s repository already lists HARICA GEANT TLS ECC 1 (2025) among its intermediates, so that path exists. All four are HARICA roots, so this stays one CA operator.

Fingerprints last checked against HARICA’s repository on 2026-08-31.

Verify the pinned roots yourself

Don’t take this page’s word for it. HARICA publishes the fingerprints of its own roots at repo.harica.gr. Pick the root from the dropdown and compare its SHA-1:

To check what the script actually installed on your machine:

awk '/BEGIN CERT/,/END CERT/' ~/.config/saxion-eduroam/saxion-eduroam-ca.pem |
  csplit -zs -f /tmp/root- -b '%d.pem' - '/BEGIN CERT/' '{*}'
for f in /tmp/root-*.pem; do
  openssl x509 -in "$f" -noout -subject -fingerprint -sha1
done

Every fingerprint printed must appear in the table above. If one does not, do not use the script. Open an issue instead.

This is the same check we run: nothing is pinned because a handshake offered it, only because the CA operator publishes it.

GÉANT moved its Trusted Certificate Service to HARICA, and the official CAT profile still pins the pre-migration USERTrust chain, which is why the official installer fails. If Saxion changes CA operator again this script will break too, but it now prints the chain the server actually served instead of hanging silently.

Requirements:

• Python 3.11+ (standard library only, no pip install, no dbus-python)
• NetworkManager 1.8+ (nmcli)
• Optional: zenity (GNOME) or kdialog (KDE) for graphical prompts; falls back to the terminal
• Optional: access to the system journal, used to explain certificate failures

Connection settings

Automated setup (recommended)

A Python script automates the full nmcli connection setup for Saxion:

# 1. Download
curl -LO https://zephyrus-linux.thectic.nl/scripts/saxion-eduroam.py

# 2. Verify checksum
echo "17cd13c629ce480ece1a7896aff7d4061347ea0082b32dfa6b23dac6b34882ad  saxion-eduroam.py" | sha256sum -c

# 3. Run
python3 saxion-eduroam.py

When the certificate stops matching

The trusted chain is pinned inside the script, so it breaks the day Saxion changes certificate authority. That is exactly what happened in #109. If the script reports unknown CA or fails to authenticate, --ignore-certificate connects without validating and prints the chain the server actually served:

python3 saxion-eduroam.py --ignore-certificate

Copy the root it reports into SAXION_CA_PEM, open an issue with it, and reconnect without the flag.

Do not leave this on. Without validation, any access point calling itself eduroam is trusted. It can terminate the TLS tunnel itself and capture the MSCHAPv2 exchange, which is crackable offline. That is your Saxion password. domain-suffix-match does not help here: it checks the name on a certificate nobody verified. Use the flag to diagnose, then reconnect properly.

SHA256: 17cd13c629ce480ece1a7896aff7d4061347ea0082b32dfa6b23dac6b34882ad

The script removes any existing eduroam profile, prompts for your username via a GUI dialog (kdialog on KDE, zenity on GNOME) or a terminal fallback, and activates the connection. Your password is never asked by the script; it is requested by your keyring (GNOME Keyring or KWallet) at connection time and stored encrypted, never in plaintext.

Useful flags:

If everything goes well, you should see something like this:

Source: saxion-eduroam.py

Manual setup via nmcli

nmcli connection add \
  type wifi \
  con-name "eduroam" \
  ssid "eduroam" \
  wifi-sec.key-mgmt wpa-eap \
  802-1x.eap peap \
  802-1x.phase2-auth mschapv2 \
  802-1x.identity "user@institution.tld" \
  802-1x.password "your-password" \
  802-1x.anonymous-identity "anonymous@saxion.nl" \
  802-1x.ca-cert file://$HOME/.config/saxion-eduroam/saxion-eduroam-ca.pem \
  802-1x.domain-suffix-match "ise.infra.saxion.net" \
  802-1x.phase2-domain-suffix-match "ise.infra.saxion.net"

Then connect:

nmcli connection up eduroam

Manual setup via GNOME Settings

1. Open Settings → Wi-Fi
2. Select eduroam
3. Go to the Security tab and fill in the settings from the table above
4. Enter your institutional credentials
5. Click Apply

Here’s what the Security tab should look like:

Removal

nmcli connection delete eduroam