Why is my RADIUS Certificate not automatically signed with the root CA Certificate on my iPhone

I have spent the last few days setting up a freeradius server with eap-tls as the only authentication method. I have used this old tutorial for setting up my own CA and generating the certificates and adjusted the older parameters to match the current ones.

So far I managed to authenticate my iPhone 6 running iOS 11.1.2 as a test device, for that I have:

  • Installed the root CA’s(the one I created) certificate on my iPhone
  • Installed a test identity profile on my iPhone with the name "Test" and test passphrase, which I converted to a .p12 file

Now when I connect to the network with the freeradius server running in debug mode, I can select EAP-TLS as the auth type and tell it to use the identity certificate. It then prompts me to trust the server’s certificate and I get a successful connection.

I have 2 questions:

  1. Why do I need to trust the server’s certificate if I have the root CA’s certificate installed? As far as I understood the way the authentication works is as follows:
  • The server and client each send their respective certificate for the other party to authenticate with the root CA’s certificate. After both are completed there is an optional challenge for the client to complete? (I’m not sure about this) and the client is authenticated

  • The server doesn’t need to be told to explicitly trust the client certificate but the client needs to explicitly trust the server’s even though they are both issued and signed by the same root CA and both parties have the certificate needed to be able to verify it

  • AFAIK the whole point of certificate-based authentication is to prevent MiTM attacks that other methods are vulnerable against. If the user initially connects to a spoofed access-point and accepts that certificate it will refuse the correct RADIUS server and leak the client certificate to the wrong server, this would be avoided if the client can verify the server certificate on its own without user intervention

  1. There is a username option when selecting the network on the iPhone, which does get matched against a backend SQL database by the freeradius server regardless of that username existing the server accepts the authentication. This page notes that the username is used in inner and outer authentication but to me, that doesn’t seem to make sense as there is no inner and outer identity in EAP-TLS. I assume there is a way to tell the radius server to only accept requests that match a username in the database but if it is not configured that way by default what is the point? Doesn’t the certificate already uniquely identify the device/user and what is the point of the username field if anything can be entered?

I would appreciate an explanation to these concepts, I’m relatively new to certificate-based authentication and RADIUS in general so I’m still learning the basics.

The goal of this endeavor is to deploy the server in an eduroam-like environment where users can generate certificates for their devices on some website, download the two needed certificates and get access without having to trust another.

I should also note that I have complete access and control over the server and my CA so I can modify anything as needed, so no quirky workarounds here.

Firewall for my devices (iPad, iPhone, surface) on a shared home WiFi network?

I am renting a room and using shared home WiFi network. The owner has setup a Netgear WiFi range extender for me. I have another roommate on the same network along with the owners. I use Nord VPN. Since a few months I have been getting weird emails…someone opens accounts (like Snapchat, SoundCloud, Pinterest etc.) in my name constantly. I close one account and two more gets opened. I accessed those accounts and they had photos and stuff, so someone had been using them. I noticed that date of birth in one account was a date of significance to me (not my dob) and year in the username was a significant year related to that date. So it is confirmed that I’m hacked. On top of that yesterday I accessed my new website hosting service and made some changes to start a website, today this person opened an account for hiring employees. I believe someone can access (Hack into) my devices through home WiFi. Is there a way to monitor who is accessing and stop it in real time like a firewall. I use iPad and surface pro. Any advice to secure my devices?

Can people hack your iPhone Via Bluetooth if you leave it on?

I leave in an apartment complex with lots of people and often times, I would be able to see Bluetooth devices that do not belong to me on my iPhone or MacBook when I search for my Bluetooth device. Does Apple Tell you/ask by default before someone with Bluetooth devices tries to Connect to your phone via Bluetooth? Or is this A potential security Vulnerability to leave your iPhone Bluetooth on at all times? (I do since I use AirPods)

I don’t remember setting or seeing any options to set Bluetooth permission on my iphone which makes me nervous.

Thank you!

How to retrieve deleted data from Iphone?

My data got deleted from iPhone. I tried to recover all images and videos using some third party softwares like dr.fone, stellar, etc but all these apps allow only preview of the data but can’t actually save the data in my Windows PC unless we buy it.

So I wanted to take disk image of entire iPhone so that I can use Foremost app to recover some of my data. But I found no resources on how to take forensic image of my iPhone using dd imager and thereby retrieve required files.

If there is no way to recover files unless we buy a third party software, atleast help me in taking image of iPhone .

Thank you.

iPhone data overwrite

How long does it take iPhone 7 (iOS 12.2) to overwrite the data of recently deleted photos/videos?

Does it happen instantly right after I take another photo/video (the new photo replaces the deleted one’s data pointer, and the deleted one is now unrecoverable?), or does it take months?

Thank you!

Can MDM on an iPhone restrict custom keyboard usage?

I have an iPhone that runs 13.3.1 (latest at this time). It’s a corporate phone and has an MDM profile installed. I’ve been using the phone for almost 2 years now with a custom keyboard (Google Keyboard). However, after recently traveling to the States, I noticed that my phone is forcing me to use the default Apple keyboard every time I try to type something. It’s been happening since 3 weeks now and this change was not caused by a system upgrade, I remember not changing/installing anything around the time when this started. It’s almost like my iPhone woke up one day and did not want me to use another keyboard, even after I had been using one for years now (jealous much?). The MDM profile installed doesn’t mention having control over keyboard. The moment I start typing, I get force switched to the Apple keyboard (without suggestions). And while I can switch to the Apple keyboard with suggestions, I can’t use my other keyboard even though it’s set as default.

This behavior began very randomly and at this point I wonder if it’s just paranoia or legit. I work in this field and so it probably isn’t irrational paranoia but I’m just looking for a logical answer. Does anyone know what this is about or has experienced similar?

What use would a privacy browser, such as Firefox Focus for iPhone, have for an internal web server?

The Mozilla Foundation has a “privacy browser” called Firefox Focus that is available for example iPhone (here). This browser has an always-on ad blocking function.

I was checking the third-party licenses used by this iPhone version (image shown below) and noticed that it includes the use of GCDWebServer.

[3rd-party licenses used by Firefox Focus]

The GitHub page for GCDWebServer says that:

GCDWebServer is a modern and lightweight GCD based HTTP 1.1 server designed to be embedded in iOS, macOS & tvOS apps.

There is a support information for this browser here but the documentation does not mention the use of an internal web server.

This issue has relevance in evaluating the risks from possible open ports in connection with determining whether to allow this browser in corporate bring-your-own-device configuration.

Question: What use would a mobile device web browser have for running an embedded web server?

A recieved text message that was never sent on iPhone

My girlfriend asked me why I texted her at 2:30 am. But I went to bed at 2am and that message was not recorded on my phone. She had an iPhone and I have a Samsung Galaxy S9. She sent me a picture of the text and yes in fact it was a message from my number but I never sent it. Can it be an old message that was sent automatically from my number? An iPhone glitch perhaps? I would like to know the reason. Thank you