27 lines
981 B
Plaintext
27 lines
981 B
Plaintext
# Fleet-generic wired 802.1X EAP-TLS + MACsec configuration.
|
|
# Identical on every host: per-host identity comes from the TPM
|
|
# (key at persistent handle, cert extracted from NV at boot).
|
|
ctrl_interface=/run/wpa_supplicant
|
|
eapol_version=3
|
|
ap_scan=0
|
|
|
|
network={
|
|
key_mgmt=IEEE8021X
|
|
eap=TLS
|
|
# RADIUS derives the real identity from the certificate CN/SAN
|
|
identity="fleet-host"
|
|
ca_cert="/etc/dot1x/radius-ca.pem"
|
|
client_cert="/run/dot1x/client.pem"
|
|
|
|
# BENCH-VERIFY: TPM key reference method on your wpa_supplicant build.
|
|
# Option A (OpenSSL tpm2 provider, direct persistent handle):
|
|
private_key="handle:0x81010001"
|
|
# Option B (tpm2-pkcs11 with a store regenerated into /run at boot):
|
|
# private_key="pkcs11:token=fleet;object=dot1x-key;type=private;pin-value=..."
|
|
|
|
macsec_policy=1 # require MACsec
|
|
macsec_integ_only=0 # confidentiality (encrypt), not integrity-only
|
|
macsec_replay_protect=1
|
|
macsec_replay_window=0
|
|
}
|