EAP-TLS - TLS 1.0 Alert [length 0002], fatal internal_error

[PENZ Robert]

Hi!

We're running openssl-1.0.1e-30.el6_6.4.x86_64 and freeradius-2.1.12-6.el6.x86_64 on a RHEL6. We're using EAP-TLS with Windows clients and IP phones with no problems. Now we want to add MFD systems from Canon also as clients and we get following openssl error, while running free radius in debug mode.  The error happens already on the second packet the radius server gets from the MFD.

First Packet:

Tue Jan 13 16:19:31 2015 : Debug: Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.15.132.2 port 39460, id=212, length=143
        User-Name = "jwf68365.mfp.tirol.local"
        EAP-Message = 0x0212001d016a776636383336352e6d66702e7469726f6c2e6c6f63616c
        NAS-IP-Address = 10.15.132.2
        Service-Type = Login-User
        Calling-Station-Id = "F4-81-39-C8-00-CE"
        NAS-Port-Id = "1:3"
        NAS-Port = 1003
        NAS-Port-Type = Ethernet
        Message-Authenticator = 0x46be9f4cbce0fb5c68c67280b8ff5784
....
Tue Jan 13 16:19:31 2015 : Info: [eap] EAP Identity
Tue Jan 13 16:19:31 2015 : Info: [eap] processing type tls
Tue Jan 13 16:19:31 2015 : Info: [tls] Requiring client certificate
Tue Jan 13 16:19:31 2015 : Info: [tls] Initiate
Tue Jan 13 16:19:31 2015 : Info: [tls] Start returned 1
....
Sending Access-Challenge of id 212 to 10.15.132.2 port 39460
        EAP-Message = 0x011300060d20
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0xea9fd73aea8cdaa07914c31bfc979134

Second Packet:

Tue Jan 13 16:19:31 2015 : Debug: Going to the next request
Tue Jan 13 16:19:31 2015 : Debug: Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.15.132.2 port 39460, id=213, length=239
        User-Name = "jwf68365.mfp.tirol.local"
        EAP-Message = 0x0213006b0d8000000061160301005c01000058030154b537821306fa9c57603eb40ab2f22a9b3cdcc496fa91589413aa835503a4d400001e002f0035000400050009000a00030008c013c014c009c00a00330039001601000011000a00080006001700180019000b000100
        NAS-IP-Address = 10.15.132.2
        Service-Type = Login-User
        Calling-Station-Id = "F4-81-39-C8-00-CE"
        NAS-Port-Id = "1:3"
        NAS-Port = 1003
        NAS-Port-Type = Ethernet
        State = 0xea9fd73aea8cdaa07914c31bfc979134
        Message-Authenticator = 0x2482cae69f6e75122c8a7fd7bbbf72a2
.......
Tue Jan 13 16:19:31 2015 : Info: [eap] EAP packet type response id 19 length 107
Tue Jan 13 16:19:31 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation
Tue Jan 13 16:19:31 2015 : Info: +++[eap] returns updated
Tue Jan 13 16:19:31 2015 : Info: ++- else else returns updated
Tue Jan 13 16:19:31 2015 : Info: Found Auth-Type = EAP
Tue Jan 13 16:19:31 2015 : Info: # Executing group from file /etc/raddb//sites-enabled/default
Tue Jan 13 16:19:31 2015 : Info: +- entering group EAP {...}
Tue Jan 13 16:19:31 2015 : Info: [eap] Request found, released from the list
Tue Jan 13 16:19:31 2015 : Info: [eap] EAP/tls
Tue Jan 13 16:19:31 2015 : Info: [eap] processing type tls
Tue Jan 13 16:19:31 2015 : Info: [tls] Authenticate
Tue Jan 13 16:19:31 2015 : Info: [tls] processing EAP-TLS
Tue Jan 13 16:19:31 2015 : Debug:   TLS Length 97
Tue Jan 13 16:19:31 2015 : Info: [tls] Length Included
Tue Jan 13 16:19:31 2015 : Info: [tls] eaptls_verify returned 11 
Tue Jan 13 16:19:31 2015 : Info: [tls]     (other): before/accept initialization
Tue Jan 13 16:19:31 2015 : Info: [tls]     TLS_accept: before/accept initialization
Tue Jan 13 16:19:31 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 005c], ClientHello  
Tue Jan 13 16:19:31 2015 : Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal internal_error  
Tue Jan 13 16:19:31 2015 : Error: TLS Alert write:fatal:internal error
Tue Jan 13 16:19:31 2015 : Error:     TLS_accept: error in SSLv3 read client hello C
Tue Jan 13 16:19:31 2015 : Error: rlm_eap: SSL error error:1408A0E3:SSL routines:SSL3_GET_CLIENT_HELLO:parse tlsext
Tue Jan 13 16:19:31 2015 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails.
Tue Jan 13 16:19:31 2015 : Debug: TLS receive handshake failed during operation
Tue Jan 13 16:19:31 2015 : Info: [tls] eaptls_process returned 4 
Tue Jan 13 16:19:31 2015 : Info: [eap] Handler failed in EAP/tls
Tue Jan 13 16:19:31 2015 : Info: [eap] Failed in EAP select
....
Sending Access-Reject of id 213 to 10.15.132.2 port 39460
        EAP-Message = 0x04130004
        Message-Authenticator = 0x00000000000000000000000000000000

Regards,
Robert Penz