<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>EAP-TLS multi clients</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>OK.<BR>
First of all I excuseme for my English. :-(<BR>
The scripts about which I speak they are those inside of the "scripts" directory of freeradius sources. (CA.all)<BR>
I use the client's certificate (cert-clt.p12) for my user who connects itself correctly to the wlan, authenticated from freeradius whit eap-tls.<BR>
Now therefore not there are more problems for that it regards the authentication.<BR>
<BR>
There is a way to obtain more certs for others clients of the wlan (multi-clients).<BR>
The CA.all script generates me only 1 server, 1 client and 1 root....<BR>
<BR>
Thanks<BR>
<BR>
<BR>
-----Messaggio originale-----<BR>
Da: freeradius-users-bounces+mlazzarini=crema.unimi.it@lists.freeradius.org per conto di K. Hoercher<BR>
Inviato: mar 29/08/2006 14.51<BR>
A: FreeRadius users mailing list<BR>
Oggetto: Re: EAP-TLS multi clients<BR>
<BR>
On 8/29/06, Lazzarini Matteo <MLazzarini@crema.unimi.it> wrote:<BR>
> I have used three scripts to generate certs root, server and client (with<BR>
> xpextension).<BR>
> They exist of the certs for multi clients to use for eap-tls?<BR>
Hi,<BR>
<BR>
Which scripts? I'm not sure what your last sentence means. Afaik you<BR>
should give out one (client) certificate per user.<BR>
<BR>
Whats the debugging output?<BR>
<BR>
Supposing it's the *same* problem as with your previous tests<BR>
regarding eap-peap/mschapv2 did you check for the hint Alan gave?<BR>
<BR>
Furthermore the whole range suggested in <44EC33BA.5060105@c-lab.de><BR>
might be useful. (regarding #1, please see<BR>
<A HREF="http://lists.shmoo.com/pipermail/hostap/2006-July/013673.html">http://lists.shmoo.com/pipermail/hostap/2006-July/013673.html</A> ). While<BR>
perhaps being the most cumbersome, a full capture like suggested might<BR>
be also most instructive.<BR>
<BR>
The nas log you showed in <44EC921B.1010706@crema.unimi.it> sadly<BR>
isn't very concise. But as it somehow mentiones an EAP-Response with<BR>
your desired username, it would be good to know if/when/how it sends<BR>
those out to freeradius, as they seem to get lost. So capturing the<BR>
traffic between nas and freeradius would be a good idea also.<BR>
<BR>
If that doesn't give yourself any clues, I'd suggest providing url's<BR>
where to download those informations. Please don't try to put some<BR>
digested information into an line mangling mua or an eventually<BR>
similar way of making it unnecessary hard to look into it for those<BR>
trying to help.<BR>
<BR>
regards<BR>
K. Hoercher<BR>
-<BR>
List info/subscribe/unsubscribe? See <A HREF="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A><BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>