EAP-TLS Certificate Validation

A colleague posed a question to me and I wanted to the consortium
expert opinion before I respond. Within EAP-TLS the user and the server
are required to both possess a certificate. Must those certificates be
issued by the same PKI chain (CA and subordinates) in order for EAP-TLS
to authenticate successfully? Let me see if I can further clarify the
questions.

The EAP-TLS Server (authenticator) has a server certificate with the
following chain:
Root CA1 --> Subordinate CA1 --> Server Certificate

The EAP-TLS Client (supplicant) has a user certificate with the
following chain:
Root CA2 --> Subordinate CA2 --> User Certificate

The EAP-TLS server TRUSTS multiple CA's including "Root CA2". Likewise
the client's trusted CA store contains "Root CA1". Obviously each
end-point implicitly trusts its own issuing authority.

Does this mean that even though the server certificate is not issued by
the same chain as the user certificate that authentication will be
successful because each end-point trusts the other's authorities? Or is
it a requirement that the certificates used in the EAP-TLS exchange be
issued by the same authorities?

I have my opinion after researching the RFC. But I wanted to see if
anyone has a definitive response.

Any help would be much appreciated. Thanks

.

Relevant Pages

  • Re: Using a Java Keytool created certificate in HTTPWebRequest.ClientCertificates
    ... Created the server X509 DER certificate using OpenSSL with the CN ... (Object sender, X509Certificate certificate, X509Chain chain, ... authenticate the client with SSL client certificate auth? ...
    (microsoft.public.dotnet.security)
  • Re: Root Certificates?????
    ... I suspect instead that the server *is* using SSL, ... public and private key. ... A signed public key is called a certificate. ... Obviously this chain can't go on ...
    (microsoft.public.mac.office.entourage)
  • Re: There are no certificates configured on this server.
    ... I received a similar error when I configured a certificate on my ISA 2004 ... chain from your certificate server? ... The certificate chain was issued by an authority that is ...
    (microsoft.public.isaserver)
  • CertGetCertificateChain() - CERT_TRUST_HAS_PREFERRED_ISSUER
    ... Using the same X.509 certificate and calling ... CertGetCertificateChainto perform the CRL check, ... The server X.509 ... The other interesting thing is that I dumped the CRL chain ...
    (microsoft.public.platformsdk.security)
  • Using EAP-TLS login / password for other applications
    ... is there any way for a wifi user authenticated by EAP-TLS (and thus who has entered his username and password to get his certificate) to use those to have access for example to a server which requires an authentication? ... I have actually tried to access a server with and without EAP-TLS but both asked me for authentication! ...
    (microsoft.public.security)