Hello,

it looks like 0.8 and the upcoming 0.9 don't allow to specify the "subject_match" parameter for WPAx-Enterprise connections. In the wpa_supplicant backend, this parameter exists and can be used just fine (see its man page).

Being able to specify the exact expected server name is an important security property if *not* using self-signed certificates or private CAs.

I'm an R&D engineer in a major 802.1X-based roaming consortium (www.eduroam.org); the lack of the subject_match feature has always been a bit of a grief for us. We are serving several million end customers; it is a bit bad publicity to tell the Linux users among them that they either have to use a plain wpa_supplicant.conf file or be somewhat insecure.