PEAP fatal bad_certificate

["Ruslan N. Marchenko" <ruff@olimp.ua>]

It seems to be not a particular question, but...

client - winxp wireless, ap - AIR-AP1131AG-E-K9, server 
1.1.6. fresh install.
certificates generated according to CA.all (with 
xp-extension and conversion to pkcs12)

 eap {
   default_eap_type = peap
   timer_expire     = 60
   ignore_unknown_eap_types = no
   cisco_accounting_username_bug = no

   md5 {
   }

   leap {
   }

   gtc {
    auth_type = PAP
   }

   tls {
    private_key_password = xxxxx
    private_key_file = ${raddbdir}/certs/merlin-crt.pem
    certificate_file = ${raddbdir}/certs/merlin-crt.pem
    CA_file = ${raddbdir}/certs/cacert.pem

    dh_key_length = 1024
    dh_file = ${raddbdir}/certs/dh
    random_file = /dev/urandom
   }
   peap {
    default_eap_type = mschapv2
   }
   mschapv2 {
   }
 }

  Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 224
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/peap
  rlm_eap: processing type peap
  rlm_eap_peap: Authenticate
  rlm_eap_tls: processing TLS
  eaptls_verify returned 7
  rlm_eap_tls: Done initial handshake
  rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal 
bad_certificate
TLS Alert read:fatal:bad certificate
    TLS_accept:failed in SSLv3 read client certificate A
rlm_eap: SSL error error:14094412:SSL 
routines:SSL3_READ_BYTES:sslv3 alert bad certificate
rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS 
session fails.
  eaptls_process returned 13
  rlm_eap_peap: EAPTLS_HANDLED
  rlm_eap: Freeing handler
  modcall[authenticate]: module "eap" returns reject for 
request 224
modcall: leaving group authenticate (returns reject) for 
request 224
auth: Failed to validate the user.



--
Olimp, System Administrator IT Dept.
Fax. +380(62)381-3428
Tel. +380(62)381-3978-5
----
Looking forward to reading yours.
 RUFF-RIPE DI76-GANDI RUFF-6BONE
     Ruslan N. Marchenko