<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt">I have read and used the make_cert_command = "${certdir}/bootstrap"; its excellent tool but it only creates
clientAuth and serverAuth and does not add PEAP which ofcourse one can add by himself. Eventhough freeradius will authenticate some supplicants will require users to first time save the cert. Windows supplicants the oids : xpclient_ext and xpserver_ext and on MAC supplicants ? ; it usually pops up message "the server certificate is not trusted because there no explicit trust settings" - this seem to require the setting of eap oid. The question is what is the difference between web server and radius server certificates with respect to ssl and wireless in the context of EAP, PEAP. Does it matter if the cn is the SSID of the wireless network for radius server auth and server domain name for webserver auth?<br><br>[ PEAP ]<br>extendedKeyUsage = 1.3.6.1.5.5.7.3.2<br>extendedKeyUsage = 1.3.6.1.5.5.7.3.1<br><br>[
clientAuth ]<br>extendedKeyUsage = 1.3.6.1.5.5.7.3.2<br><br>[ serverAuth ]<br>extendedKeyUsage = 1.3.6.1.5.5.7.3.1<br><div> </div>==================================================<div> </div><div>Benjamin K. Eshun<div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><br><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;">----- Message d'origine ----<br>De : Alan DeKok <aland@deployingradius.com><br>À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br>Envoyé le : Lundi, 9 Juillet 2007, 18h12mn 28s<br>Objet : Re: PEAP certificates, signing requirements and examples<br><br><div>Eshun Benjamin wrote:<br>> Hi All,<br>> I came across this infomation and tought it would be nice to drop it<br>> here. Eventhough it is ssl issue it has to do with PEAP. Just to<br>> discuss; any comments.<br><br> This is documented in eap.conf, among other
places. It's on the Wiki,<br>in the script files that create the test certificates for the server, etc.<br><br> In 2.0, a brand-new install of the server will automatically create<br>test certificates with the right OID's for Windows.<br><br> Alan DeKok.<br>- <br>List info/subscribe/unsubscribe? See <a target="_blank" href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br></div></div><br></div></div></div><br>
<hr size="1">
Ne gardez plus qu'une seule adresse mail ! <a href="http://www.trueswitch.com/yahoo-fr/">Copiez vos mails</a> vers Yahoo! Mail </body></html>