To make life easier I want to uncheck the Validate Server Certificate in my XP client – whats wrong with doing that?
You should *ALWAYS* validate the server certificate – the option in the supplicant (be it Windows native, SecureW2, OpenSEA et al) should always be enabled. Certification is one of the main securing blocks of EAP, which underpins the eduroam service. If you don’t verify that the RADIUS server (which is handling your sensitive authentication credentials) is legitimate and not being spoofed by an unscrupulous person, you are leaving yourself open to having your credentials stolen. Maintaining the security of your credentials is one of the requirements of the eduroam usage policy that you subscribe to as part of using the service – ie. it is mandatory.
