pfSense » pfSense Packages

Windows EAP config has an option to filter which user certificates can be used by their issuer, so only these certificates appear in the dropdown on the GUI (or if there is only one matching certificate, the user is not prompted for one). If a user certificate is included in the download archive, could the following node be included in the script to filter by that certificate's issuing CA? Or even for the VPN's configured peer CA?

...
<TLSExtensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">
     <FilteringInfo xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV3">
          <CAHashList Enabled="true">
               <IssuerHash>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 </IssuerHash>
          </CAHashList>
     </FilteringInfo>
</TLSExtensions>
...

This is useful in cases where the user has multiple user certificates installed with Client Authentication capability issued by different authorities (maybe just me lol), as it filters to just the certs this VPN will accept.