fix: update eduroam CA certificates and improve connection handling (#110)

## Summary

Updates the pinned RADIUS CA certificates from the outdated
USERTrust/GEANT chain to the current HARICA roots that Saxion's server
actually uses, and improves the connection activation flow with explicit
timeouts and better error messaging.

## Type of change

- [x] `fix` — bug fix (broken link, incorrect command, layout issue)
- [x] `content` — update or improve existing content

## Details

### Script Changes (`saxion-eduroam.py`)

**Certificate Update:**
- Replaces pinned certificates with the actual chain served by
`ise.infra.saxion.net`:
  - Hellenic Academic and Research Institutions RootCA 2015 (depth=3)
  - HARICA TLS RSA Root CA 2021 (depth=2)
- Removes the outdated USERTrust RSA CA and GEANT OV RSA CA 4 that
caused "unknown CA" failures after GÉANT's migration to HARICA
- Adds comprehensive documentation explaining the certificate chain, why
pinning is necessary, and how to refresh if Saxion changes CAs again

**Connection Handling Improvements:**
- Adds `CONNECT_TIMEOUT = 45` constant to prevent the script appearing
frozen during the 90-second default nmcli wait
- Passes `--wait` flag to nmcli with explicit timeout
- Adds subprocess timeout as a backstop
- Prints status message during connection attempt so users know the
script is still running
- Improves error handling to log full nmcli errors before checking for
certificate failures
- Adds graceful timeout handling with helpful guidance to check logs

**File Permissions:**
- Changes CA certificate file permissions from 0600 to 0644, since these
are public root certificates (not keys) and NetworkManager reads them as
a system service

### Documentation Changes

**English (`eduroam-network-installation.md`):**
- Updates explanation of certificate pinning to reference HARICA roots
instead of USERTrust/GEANT
- Adds context about GÉANT's migration and the previous failure mode
- Updates SHA256 checksum

**Dutch (`eduroam-network-installation.nl.md`):**
- Parallel updates to Dutch documentation
- Updates SHA256 checksum

## Checklist

- [x] PR title follows the commit convention
- [x] Both EN and NL versions updated
- [x] No broken image references
- [x] Changes tested against actual certificate chain from live
handshake

Author: Stensel8

src/content/docs/networking/eduroam-network-installation.md

@@ -36,9 +36,14 @@ script, plus `domain-suffix-match` (the modern replacement for the deprecated
 
 The script used to point at the system trust store, which meant any of the roughly 150
 public CAs your distribution ships could vouch for a server calling itself
-`ise.infra.saxion.net`. It now trusts only the chain Saxion publishes through eduroam
-CAT — USERTrust RSA Certification Authority and GEANT OV RSA CA 4 — which is what the
-official CAT installers do.
+`ise.infra.saxion.net`. It now trusts only the HARICA roots that Saxion's RADIUS server
+actually chains to — Hellenic Academic and Research Institutions RootCA 2015 and HARICA
+TLS RSA Root CA 2021 — which is what the official CAT installers do.
+
+GÉANT moved its Trusted Certificate Service to HARICA, so an earlier version of this
+script pinned the pre-migration USERTrust chain and every connection failed with
+`unknown CA`. If Saxion changes certificate authority again the same thing will happen;
+the script now says so explicitly instead of hanging.
 
 **Requirements:**
 - Python 3.10+
@@ -67,13 +72,34 @@ A Python script automates the full `nmcli` connection setup for Saxion:
 curl -LO https://zephyrus-linux.stensel.nl/scripts/saxion-eduroam.py
 
 # 2. Verify checksum
-echo "fad48d500af6eb90deec5e0e21ccf7cbaaac6678b5d3e8cb4f26d814c525e3d2  saxion-eduroam.py" | sha256sum -c
+echo "447a0979166cc801ba7406cc660b0403156532862ac031835291bb9d721f33e1  saxion-eduroam.py" | sha256sum -c
 
 # 3. Run
 python3 saxion-eduroam.py
 ```
 
-**SHA256:** `fad48d500af6eb90deec5e0e21ccf7cbaaac6678b5d3e8cb4f26d814c525e3d2`
+#### When the certificate stops matching
+
+The trusted chain is pinned inside the script, so it breaks the day Saxion
+changes certificate authority — which is exactly what happened in
+[#109](https://github.com/THectic-NL/Zephyrus-Linux/issues/109). If the script
+reports `unknown CA` or fails to authenticate, `--ignore-certificate` connects
+without validating and prints the chain the server actually served:
+
+```bash
+python3 saxion-eduroam.py --ignore-certificate
+```
+
+Copy the root it reports into `SAXION_CA_PEM`, open an issue with it, and
+reconnect without the flag.
+
+**Do not leave this on.** Without validation, any access point calling itself
+`eduroam` is trusted. It can terminate the TLS tunnel itself and capture the
+MSCHAPv2 exchange, which is crackable offline — that is your Saxion password.
+`domain-suffix-match` does not help here: it checks the name on a certificate
+nobody verified. Use the flag to diagnose, then reconnect properly.
+
+**SHA256:** `447a0979166cc801ba7406cc660b0403156532862ac031835291bb9d721f33e1`
 
 The script removes any existing eduroam profile, prompts for your **username** via a GUI dialog (zenity, kdialog, or yad) or terminal fallback, and activates the connection. Your password is never asked by the script; it is requested by your GNOME Keyring at connection time and stored securely, never in plaintext.
 

src/content/docs/networking/eduroam-network-installation.nl.md

@@ -36,9 +36,14 @@ is vastgelegd, plus `domain-suffix-match` (de moderne vervanging voor het veroud
 
 Het script wees eerder naar de systeem-truststore. Daarmee kon elk van de ongeveer 150
 publieke CA's die je distributie meelevert instaan voor een server die zich
-`ise.infra.saxion.net` noemt. Nu wordt alleen de keten vertrouwd die Saxion via eduroam
-CAT publiceert — USERTrust RSA Certification Authority en GEANT OV RSA CA 4 — precies
-wat de officiële CAT-installers doen.
+`ise.infra.saxion.net` noemt. Nu worden alleen de HARICA-roots vertrouwd waar Saxion's
+RADIUS-server daadwerkelijk naartoe ketent — Hellenic Academic and Research Institutions
+RootCA 2015 en HARICA TLS RSA Root CA 2021 — precies wat de officiële CAT-installers doen.
+
+GÉANT heeft zijn Trusted Certificate Service naar HARICA verhuisd. Een eerdere versie van
+dit script legde daardoor nog de oude USERTrust-keten vast en elke verbinding faalde met
+`unknown CA`. Wisselt Saxion opnieuw van certificaatautoriteit, dan gebeurt hetzelfde;
+het script meldt dat nu expliciet in plaats van vast te lopen.
 
 **Vereisten:**
 - Python 3.10+
@@ -67,13 +72,36 @@ Een Python-script automatiseert de volledige `nmcli`-verbindingsconfiguratie voo
 curl -LO https://zephyrus-linux.stensel.nl/scripts/saxion-eduroam.py
 
 # 2. Controleer de checksum
-echo "fad48d500af6eb90deec5e0e21ccf7cbaaac6678b5d3e8cb4f26d814c525e3d2  saxion-eduroam.py" | sha256sum -c
+echo "447a0979166cc801ba7406cc660b0403156532862ac031835291bb9d721f33e1  saxion-eduroam.py" | sha256sum -c
 
 # 3. Uitvoeren
 python3 saxion-eduroam.py
 ```
 
-**SHA256:** `fad48d500af6eb90deec5e0e21ccf7cbaaac6678b5d3e8cb4f26d814c525e3d2`
+#### Als het certificaat niet meer klopt
+
+De vertrouwde keten ligt vast in het script, dus die breekt zodra Saxion van
+certificaatautoriteit wisselt — precies wat er in
+[#109](https://github.com/THectic-NL/Zephyrus-Linux/issues/109) gebeurde. Meldt
+het script `unknown CA` of lukt authenticatie niet, dan verbindt
+`--ignore-certificate` zonder te valideren en toont het welke keten de server
+werkelijk stuurde:
+
+```bash
+python3 saxion-eduroam.py --ignore-certificate
+```
+
+Zet de root die eruit komt in `SAXION_CA_PEM`, meld hem in een issue, en verbind
+daarna opnieuw zonder de vlag.
+
+**Laat dit niet aanstaan.** Zonder validatie wordt elk access point dat zich
+`eduroam` noemt vertrouwd. Dat kan de TLS-tunnel zelf afsluiten en de
+MSCHAPv2-uitwisseling opvangen, die offline te kraken is — dat is je
+Saxion-wachtwoord. `domain-suffix-match` helpt hier niet: die controleert de naam
+op een certificaat dat niemand geverifieerd heeft. Gebruik de vlag om te
+diagnosticeren en verbind daarna netjes.
+
+**SHA256:** `447a0979166cc801ba7406cc660b0403156532862ac031835291bb9d721f33e1`
 
 Het script verwijdert een eventueel bestaand eduroam-profiel, vraagt je **gebruikersnaam** via een GUI-dialoog (zenity, kdialog of yad) of terminal-fallback, en activeert de verbinding. Je wachtwoord wordt nooit door het script gevraagd; dat wordt bij het verbinden opgevraagd door je GNOME Keyring en veilig opgeslagen, nooit in platte tekst.