Bug 342728

On WPA2 enterprise networks, the certificate identity information must ALWAYS be checked. There is no way to securely connect to a WPA2 enterprise network using plasma-nm.
This issue is exploited in the wild, on large public networks such as eduroam.

In ANY TLS connection, there are 3 things to verify:
1. The identity of the person you're trying to establish a connection with (subject)
2. The signature
3. Whether the signature is still valid.

The first is made impossible by this regression and introduces a security hole, where anybody can capture credentials, provided they have ANY certificate from the same CA.

It is current best practise to implement public certificates on a WPA2 enterprise network, because this allows new devices to automatically PIN the CA and altsubjectname information.  The old KDE networkmanagement implementation worked, because there was the option to select which server to connect to, which did a altsubject_match in wpa_supplicant.

On OS X and IOS, the fingerprint of the certificate is pinned, this prevents exploitation, but presents users with a dialog to override and does not allow replacing of the certificates.

I propose that CA + altsubjectname pinning is implemented (though this may be a network-manager issue) and at the very least that the option to "Connect to these servers" is returned.

Reproducible: Always