<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2722" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>When I enable RASTLS, I see the following
error:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>[1304] 19:33:27:968:
EapTlsInvokeIdentityUI<BR>[1304] 19:33:27:968: GetCertInfo<BR>[1304]
19:33:27:984: FCheckSCardCertAndCanOpenSilentContext<BR>[1304] 19:33:27:984:
FGetEKUUsage<BR>[1304] 19:33:27:984: Acquiring Context for Container Name:
{226FADA0-66DE-4423-BFBF-448D710E1BF2}, ProvName: Microsoft Base Cryptographic
Provider v1.0, ProvType 0x1<BR>[1304] 19:33:28:000: FCheckTimeValidity<BR>[1304]
19:33:28:000: Add Selected Cert to List<BR>[1304] 19:33:28:000:
FCheckSCardCertAndCanOpenSilentContext<BR>[1304] 19:33:28:000:
FGetEKUUsage<BR>[1304] 19:33:28:000: Acquiring Context for Container Name:
{F4FC41A8-ECDF-4B9A-A613-A457D74DDFF8}, ProvName: Microsoft Enhanced
Cryptographic Provider v1.0, ProvType 0x1<BR>[1304] 19:33:28:015:
FCheckTimeValidity<BR>[1304] 19:33:28:015: Add Selected Cert to List<BR>[1304]
19:33:28:015: GroupCertificates<BR>[1304] 19:33:35:078: <BR>[1304] 19:33:35:078:
EapTlsBegin(Jurgen Tessers)<BR>[1304] 19:33:35:078: State change to
Initial<BR>[1304] 19:33:35:078: EapTlsBegin: Detected 8021X
authentication<BR>[1304] 19:33:35:078: MaxTLSMessageLength is now
16384<BR>[1304] 19:33:35:078: <BR>[1304] 19:33:35:078: EapTlsMakeMessage(jurgen
tessers)<BR>[1304] 19:33:35:078: >> Received Request (Code: 1) packet: Id:
1, Length: 6, Type: 13, TLS blob length: 0. Flags: S<BR>[1304] 19:33:35:078:
EapTlsCMakeMessage<BR>[1304] 19:33:35:078: EapTlsReset<BR>[1304] 19:33:35:078:
State change to Initial<BR>[1304] 19:33:35:078: GetCredentials<BR>[1304]
19:33:35:078: Flag is Client and Store is Current User<BR>[1304] 19:33:35:078:
GetCachedCredentials<BR>[1304] 19:33:35:078: FreeCachedCredentials<BR>[1304]
19:33:35:078: AssociatePinWithCertificate<BR>[1304] 19:33:35:093: The name in
the certificate is: Jurgen Tessers<BR>[1304] 19:33:35:093: Will validate server
cert<BR>[1304] 19:33:35:125: MakeReplyMessage<BR>[1304] 19:33:35:125:
SecurityContextFunction<BR>[1304] 19:33:35:125: InitializeSecurityContext
returned 0x90312<BR>[1304] 19:33:35:125: State change to SentHello<BR>[1304]
19:33:35:125: BuildPacket<BR>[1304] 19:33:35:125: << Sending Response
(Code: 2) packet: Id: 1, Length: 80, Type: 13, TLS blob length: 70. Flags:
L<BR>[2448] 19:33:35:140: <BR>[2448] 19:33:35:140: EapTlsMakeMessage(jurgen
tessers)<BR>[2448] 19:33:35:140: >> Received Request (Code: 1) packet: Id:
2, Length: 1030, Type: 13, TLS blob length: 1020. Flags: L<BR>[2448]
19:33:35:140: EapTlsCMakeMessage<BR>[2448] 19:33:35:140:
MakeReplyMessage<BR>[2448] 19:33:35:140: Reallocating input TLS blob
buffer<BR>[2448] 19:33:35:140: SecurityContextFunction<BR>[2448] 19:33:35:281:
InitializeSecurityContext returned 0x80096004<BR>[2448] 19:33:35:281: State
change to RecdFinished. Error: 0x80096004<BR>[2448] 19:33:35:281:
BuildPacket<BR>[2448] 19:33:35:281: << Sending Response (Code: 2) packet:
Id: 2, Length: 6, Type: 13, TLS blob length: 0. Flags: <BR>[2448] 19:33:35:281:
<BR>[2448] 19:33:35:281: EapTlsMakeMessage(jurgen tessers)<BR>[2448]
19:33:35:281: >> Received Request (Code: 1) packet: Id: 3, Length: 10,
Type: 13, TLS blob length: 0. Flags: L<BR>[2448] 19:33:35:281:
EapTlsCMakeMessage<BR>[2448] 19:33:35:281: Unexpected code: 1 in state
RecdFinished<BR>[2448] 19:34:05:296: EapTlsEnd<BR>[2448] 19:34:05:296:
EapTlsEnd(jurgen tessers)<BR>[2448] 19:34:05:296: <STRONG>Auth failed so freeing
cached creds</STRONG>.<BR>[2448] 19:34:05:296: FreeCachedCredentials<BR>[2448]
19:34:05:296: <BR>[2448] 19:34:05:296: EapTlsBegin(Jurgen Tessers)<BR>[2448]
19:34:05:296: State change to Initial<BR>[2448] 19:34:05:296: EapTlsBegin:
Detected 8021X authentication<BR>[2448] 19:34:05:296: MaxTLSMessageLength is now
16384</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>etc, etc . . .. </FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=ben.walding@gmail.com href="mailto:ben.walding@gmail.com">Ben
Walding</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=freeradius-users@lists.freeradius.org
href="mailto:freeradius-users@lists.freeradius.org">FreeRadius users mailing
list</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, October 10, 2005 2:18
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: authenticate problem XP
eap/tls</DIV>
<DIV><BR></DIV>Make sure that you either don't validate the server
certificate, or that if you do, that the CA is selected.<BR><BR>The XP
supplicant will just keep hammering at the server without accepting the
response if the CA / server checking doesn't pass. <BR><BR>The other thing to
do is look at the RASTLS (and/or EAPOL) logs.<BR><BR>eg: <BR><PRE><A name=130>netsh ras set tracing rastls enabled<BR><BR>And then take a look at the files in c:\windows\tracing<BR><BR>Cheers,
<BR><BR>Ben<BR></A></PRE><BR>
<DIV><SPAN class=gmail_quote>On 10/10/05, <B class=gmail_sendername>Thuis
Algemeen</B> <<A
href="mailto:thuis-algemeen@chello.nl">thuis-algemeen@chello.nl</A>>
wrote:</SPAN>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0pt 0pt 0pt 0.8ex; BORDER-LEFT: rgb(204,204,204) 1px solid">Thanks
Allan,<BR><BR>I used a file called xpextensions with both a client section
and server a<BR>server section.<BR>The client certificate present on the
laptop display's : Clientverificatie<BR>(1.3.6.1.5.5.7.3.2)<BR>The server
certificate present on the server display's : Verificatie van de <BR>server
(1.3.6.1.5.5.7.3.1)<BR><BR>----- Original Message -----<BR>From: "Alan
DeKok" <<A href="mailto:aland@ox.org">aland@ox.org</A>><BR>To:
"FreeRadius users mailing list" <<A
href="mailto:freeradius-users@lists.freeradius.org">
freeradius-users@lists.freeradius.org</A>><BR>Sent: Sunday, October 09,
2005 5:49 PM<BR>Subject: Re: authenticate problem XP eap/tls<BR><BR><BR>>
"Thuis Algemeen" <<A href="mailto:thuis-algemeen@chello.nl">
thuis-algemeen@chello.nl</A>> wrote:<BR>>> Here the log
from freeradius, the onl error I can see is :<BR>>> "TLS_accept:error
in SSLv3 read client certificate A".<BR>><BR>> That error
is in the middle of the authentication session, and <BR>> doesn't mean
anything.<BR>><BR>> Do the certificates you're using have
the Windows OID?<BR>><BR>> Alan DeKok.<BR>><BR>>
-<BR>> List info/subscribe/unsubscribe? See<BR>> <A
href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A><BR><BR>-<BR>List
info/subscribe/unsubscribe? See <A
href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A><BR></BLOCKQUOTE></DIV><BR>
<P>
<HR>
<P></P>- <BR>List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html</BLOCKQUOTE></BODY></HTML>