I am having terrible trouble connecting to my school WPA2 PEAP MSCHAPV2 wifi. I've tried Network Manager, wicd and connman and most recently I am connecting via wpa_supplicant.
The school does not require a CA certificate. I know this is ill-advised but I don't have responsibility for that. The connection works immediately in Windows, with which I dual boot, so I know the hardware is working.
I have included dmesg output, wpa_supplicant.conf, wpa_supplicant -dd debug output, and relevant wireshark packets in this Google doc:
https://docs.google.com/document/d/1HawjC5BS5BHBb5zxFUcWR4TInAhZXVDdt7ReGW0LiKg
The problem occurs after the Client Hello when the AP disconnects because of a handshake failure.
I have been working for days on this and have tried the system-ca-certs=false workaround. Any pointers would be gratefully received.
Update:
I notice that Wireshark says that the client hello is TLS version 1.0. I believe this is deprecated now? Does anyone know how to force the use of TLS 1.1 or 1.2 in the handshake? I will keep researching.
This post suggests that there are servers that will drop the connection if the client doesn't specify a TLS version higher than 1.0.
New update:
Looking at the Wireshark packets from my Ubuntu laptop, which connects successfully, I can see that server negotiates a cipher suite (tls_rsa_with_3des_ede_cbc_sh) that Debian doesn't support. I originally thought this could be the problem, but oddly, when Windows connects the server negotiates a different cipher suite that Debian does support.