What kind of error in client-cert using EAP?

[Alexandros Gougousoudis]

Hi,

I have trouble with one XP-SP2 client, using a certificate to make 
802.1x Auth over EAP-TLS. The cert is a machine cert. On the serverside 
I get this (using -X -A) in authenticate:

modcall: entering group authenticate for request 33
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/tls
   rlm_eap: processing type tls
   rlm_eap_tls: Authenticate
   rlm_eap_tls: processing TLS
rlm_eap_tls:  Length Included
   eaptls_verify returned 11
     (other): before/accept initialization
     TLS_accept: before/accept initialization
   rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello
     TLS_accept: SSLv3 read client hello A
   rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
     TLS_accept: SSLv3 write server hello A
   rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ef8], Certificate
     TLS_accept: SSLv3 write certificate A
   rlm_eap_tls: >>> TLS 1.0 Handshake [length 00bd], CertificateRequest
     TLS_accept: SSLv3 write certificate request A
     TLS_accept: SSLv3 flush data
     TLS_accept:error in SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
   eaptls_process returned 13
   modcall[authenticate]: module "eap" returns handled for request 33
modcall: leaving group authenticate (returns handled) for request 33
Sending Access-Challenge of id 0 to 10.48.244.21 port 49154
         EAP-Message = 0x0125040a0dc00000100e1[...]

Which indicates that there is a problem in the client-cert. Can it be 
more detailed? I exported the cert and the key now 4 times in different 
manners (as p12, as der) and the errors is still there. Extended 
attribute is also included. The funny thing is, that I already have 5 XP 
machines running in my network, doing an EAP-TLS auth over the switch.

It means also that in my authorize section (Auth-Type := EAP) I can get 
a Access-Accept Message. On the server I get the Access-Requests, create 
a Access-Challenge and thats all. Theres nothing coming back from the 
client.


Please help
  Alex


-- 
ServiceCenter IT - Alexandros Gougousoudis (Leiter)

Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule 
für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst 
Busch".

Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445