FreeRADIUS Version 2.0.1, for host i586-mandriva-linux-gnu, built on Jan 24 2008 at 21:20:10
Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. 
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A 
PARTICULAR PURPOSE. 
You may redistribute copies of FreeRADIUS under the terms of the 
GNU General Public License. 
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including configuration file /etc/raddb/snmp.conf
including configuration file /etc/raddb/eap.conf
including configuration file /etc/raddb/policy.conf
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/default
including dictionary file /etc/raddb/dictionary
main {
	prefix = "/usr"
	localstatedir = "/var"
	logdir = "/var/log/radius"
	libdir = "/usr/lib/freeradius"
	radacctdir = "/var/log/radius/radacct"
	hostname_lookups = no
	max_request_time = 30
	cleanup_delay = 5
	max_requests = 1024
	allow_core_dumps = no
	pidfile = "/var/run/radiusd/radiusd.pid"
	user = "radius"
	group = "radius"
	checkrad = "/usr/sbin/checkrad"
	debug_level = 0
	proxy_requests = yes
 security {
	max_attributes = 200
	reject_delay = 1
	status_server = no
 }
}
 client 127.0.0.1 {
	require_message_authenticator = no
	secret = "test"
	shortname = "localhost"
 }
 client 192.168.0.8 {
	require_message_authenticator = no
	secret = "test"
	shortname = "AP-Tower"
 }
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
	retry_delay = 5
	retry_count = 3
	default_fallback = no
	dead_time = 120
	wake_all_if_all_dead = no
 }
 home_server localhost {
	ipaddr = 127.0.0.1
	port = 1812
	type = "auth"
	secret = "testing123"
	response_window = 20
	max_outstanding = 65536
	zombie_period = 40
	status_check = "status-server"
	ping_check = "none"
	ping_interval = 30
	check_interval = 30
	num_answers_to_alive = 3
	num_pings_to_alive = 3
	revive_interval = 120
	status_check_timeout = 4
 }
 home_server_pool my_auth_failover {
	type = fail-over
	home_server = localhost
 }
 realm example.com {
	auth_pool = my_auth_failover
 }
 realm bla {
	authhost = LOCAL
	accthost = LOCAL
 }
 realm LOCAL {
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating exec
  exec {
	wait = yes
	input_pairs = "request"
	shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating expr
 Module: Linked to module rlm_expiration
 Module: Instantiating expiration
  expiration {
	reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating logintime
  logintime {
	reply-message = "You are calling outside your allowed timespan  "
	minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server {
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_eap
 Module: Instantiating eap
  eap {
	default_eap_type = "tls"
	timer_expire = 60
	ignore_unknown_eap_types = no
	cisco_accounting_username_bug = no
  }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
	rsa_key_exchange = no
	dh_key_exchange = yes
	rsa_key_length = 512
	dh_key_length = 512
	verify_depth = 0
	pem_file_type = yes
	private_key_file = "/etc/pki/tls/private/server.pem"
	certificate_file = "/etc/pki/tls/private/server.pem"
	CA_file = "/etc/pki/tls/certs/ca.pem"
	private_key_password = "whatever"
	dh_file = "/etc/raddb/certs/dh"
	random_file = "/etc/raddb/certs/random"
	fragment_size = 1024
	include_length = yes
	check_crl = no
	check_cert_cn = "%{User-Name}"
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating preprocess
  preprocess {
	huntgroups = "/etc/raddb/huntgroups"
	hints = "/etc/raddb/hints"
	with_ascend_hack = no
	ascend_channels_per_line = 23
	with_ntdomain_hack = no
	with_specialix_jetstream_hack = no
	with_cisco_vsa_hack = no
	with_alvarion_vsa_hack = no
  }
 Module: Linked to module rlm_detail
 Module: Instantiating auth_log
  detail auth_log {
	detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d"
	header = "%t"
	detailperm = 384
	dirperm = 493
	locking = no
	log_packet_header = no
  }
 Module: Linked to module rlm_realm
 Module: Instantiating ntdomain
  realm ntdomain {
	format = "prefix"
	delimiter = "\"
	ignore_default = no
	ignore_null = no
  }
 Module: Linked to module rlm_files
 Module: Instantiating files
  files {
	usersfile = "/etc/raddb/users"
	compat = "no"
  }
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating acct_unique
  acct_unique {
	key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Instantiating detail
  detail {
	detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
	header = "%t"
	detailperm = 384
	dirperm = 493
	locking = no
	log_packet_header = no
  }
 Module: Linked to module rlm_radutmp
 Module: Instantiating radutmp
  radutmp {
	filename = "/var/log/radius/radutmp"
	username = "%{User-Name}"
	case_sensitive = yes
	check_with_nas = yes
	perm = 384
	callerid = yes
  }
 Module: Checking session {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Instantiating reply_log
  detail reply_log {
	detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d"
	header = "%t"
	detailperm = 384
	dirperm = 493
	locking = no
	log_packet_header = no
  }
 }
}
radiusd: #### Opening IP addresses and Ports ####
listen {
	type = "auth"
	ipaddr = *
	port = 0
}
listen {
	type = "acct"
	ipaddr = *
	port = 0
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.0.8 port 1128, id=143, length=203
	Message-Authenticator = 0x6a9456153eae379a334abd83a66943de
	Service-Type = Framed-User
	User-Name = "bla\\user@example.com"
	Framed-MTU = 1488
	Called-Station-Id = "000FB5BA4F59:Flugplatz"
	Calling-Station-Id = "00127946D8F2"
	NAS-Identifier = "AP-Tower"
	NAS-Port-Type = Wireless-802.11
	Connect-Info = "CONNECT 11Mbps 802.11b"
	EAP-Message = 0x0200001901626c615c75736572406578616d706c652e636f6d
	NAS-IP-Address = 192.168.0.8
	NAS-Port = 2
	NAS-Port-Id = "STA port # 2"
+- entering group authorize
++[preprocess] returns ok
	expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
	expand: %t -> Tue Feb  5 22:55:02 2008
++[auth_log] returns ok
    rlm_realm: Looking up realm "bla" for User-Name = "bla\user@example.com"
    rlm_realm: Found realm "bla"
    rlm_realm: Adding Stripped-User-Name = "user@example.com"
    rlm_realm: Proxying request from user user@example.com to realm bla
    rlm_realm: Adding Realm = "bla"
    rlm_realm: Authentication realm is LOCAL.
++[ntdomain] returns noop
  rlm_eap: EAP packet type response id 0 length 25
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
    users: Matched entry DEFAULT at line 226
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
+- entering group authenticate
  rlm_eap: EAP Identity
  rlm_eap: processing type tls
 rlm_eap_tls: Requiring client certificate
  rlm_eap_tls: Initiate
  rlm_eap_tls: Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 143 to 192.168.0.8 port 1128
	EAP-Message = 0x010100060d20
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xd855ce66d854c3db82f4be0093fad79e
Finished request 0.
Going to the next request
Waking up in 0.9 seconds. 
rad_recv: Access-Request packet from host 192.168.0.8 port 1128, id=144, length=270
	Message-Authenticator = 0xc3e9820d65ceacf0da25985d0491a9dc
	Service-Type = Framed-User
	User-Name = "bla\\user@example.com"
	Framed-MTU = 1488
	State = 0xd855ce66d854c3db82f4be0093fad79e
	Called-Station-Id = "000FB5BA4F59:Flugplatz"
	Calling-Station-Id = "00127946D8F2"
	NAS-Identifier = "AP-Tower"
	NAS-Port-Type = Wireless-802.11
	Connect-Info = "CONNECT 11Mbps 802.11b"
	EAP-Message = 0x0201004a0d8000000040160301003b010000370301a7e723f972662a0dd9f47bf100b53967eacf0169d5d1cbf872f42a65f2a3113200001000040005000a000900640062000300060100
	NAS-IP-Address = 192.168.0.8
	NAS-Port = 2
	NAS-Port-Id = "STA port # 2"
+- entering group authorize
++[preprocess] returns ok
	expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
	expand: %t -> Tue Feb  5 22:55:02 2008
++[auth_log] returns ok
    rlm_realm: Looking up realm "bla" for User-Name = "bla\user@example.com"
    rlm_realm: Found realm "bla"
    rlm_realm: Adding Stripped-User-Name = "user@example.com"
    rlm_realm: Proxying request from user user@example.com to realm bla
    rlm_realm: Adding Realm = "bla"
    rlm_realm: Authentication realm is LOCAL.
++[ntdomain] returns noop
  rlm_eap: EAP packet type response id 1 length 74
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
    users: Matched entry DEFAULT at line 226
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
+- entering group authenticate
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/tls
  rlm_eap: processing type tls
  rlm_eap_tls: Authenticate
  rlm_eap_tls: processing TLS
  TLS Length 64
rlm_eap_tls:  Length Included
  eaptls_verify returned 11 
    (other): before/accept initialization 
    TLS_accept: before/accept initialization 
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 003b], ClientHello  
    TLS_accept: SSLv3 read client hello A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello  
    TLS_accept: SSLv3 write server hello A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 075b], Certificate  
    TLS_accept: SSLv3 write certificate A 
  rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a6], CertificateRequest  
    TLS_accept: SSLv3 write certificate request A 
    TLS_accept: SSLv3 flush data 
    TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase 
In SSL Accept mode  
  eaptls_process returned 13 
++[eap] returns handled
Sending Access-Challenge of id 144 to 192.168.0.8 port 1128
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = 0x274e032acd43a5bca611d725
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xd855ce66d957c3db82f4be0093fad79e
Finished request 1.
Going to the next request
Waking up in 0.8 seconds. 
rad_recv: Access-Request packet from host 192.168.0.8 port 1128, id=145, length=202
	Message-Authenticator = 0x9ad3446768f6a2edfaac1bf4bc2fb1c0
	Service-Type = Framed-User
	User-Name = "bla\\user@example.com"
	Framed-MTU = 1488
	State = 0xd855ce66d957c3db82f4be0093fad79e
	Called-Station-Id = "000FB5BA4F59:Flugplatz"
	Calling-Station-Id = "00127946D8F2"
	NAS-Identifier = "AP-Tower"
	NAS-Port-Type = Wireless-802.11
	Connect-Info = "CONNECT 11Mbps 802.11b"
	EAP-Message = 0x020200060d00
	NAS-IP-Address = 192.168.0.8
	NAS-Port = 2
	NAS-Port-Id = "STA port # 2"
+- entering group authorize
++[preprocess] returns ok
	expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
	expand: %t -> Tue Feb  5 22:55:03 2008
++[auth_log] returns ok
    rlm_realm: Looking up realm "bla" for User-Name = "bla\user@example.com"
    rlm_realm: Found realm "bla"
    rlm_realm: Adding Stripped-User-Name = "user@example.com"
    rlm_realm: Proxying request from user user@example.com to realm bla
    rlm_realm: Adding Realm = "bla"
    rlm_realm: Authentication realm is LOCAL.
++[ntdomain] returns noop
  rlm_eap: EAP packet type response id 2 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
    users: Matched entry DEFAULT at line 226
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
+- entering group authenticate
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/tls
  rlm_eap: processing type tls
  rlm_eap_tls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1 
  eaptls_process returned 13 
++[eap] returns handled
Sending Access-Challenge of id 145 to 192.168.0.8 port 1128
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = 0x733112301006035504071309
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xd855ce66da56c3db82f4be0093fad79e
Finished request 2.
Going to the next request
Waking up in 0.7 seconds. 
rad_recv: Access-Request packet from host 192.168.0.8 port 1128, id=146, length=202
	Message-Authenticator = 0x0835adbae1c68d7427e1db3683525dcb
	Service-Type = Framed-User
	User-Name = "bla\\user@example.com"
	Framed-MTU = 1488
	State = 0xd855ce66da56c3db82f4be0093fad79e
	Called-Station-Id = "000FB5BA4F59:Flugplatz"
	Calling-Station-Id = "00127946D8F2"
	NAS-Identifier = "AP-Tower"
	NAS-Port-Type = Wireless-802.11
	Connect-Info = "CONNECT 11Mbps 802.11b"
	EAP-Message = 0x020300060d00
	NAS-IP-Address = 192.168.0.8
	NAS-Port = 2
	NAS-Port-Id = "STA port # 2"
+- entering group authorize
++[preprocess] returns ok
	expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
	expand: %t -> Tue Feb  5 22:55:03 2008
++[auth_log] returns ok
    rlm_realm: Looking up realm "bla" for User-Name = "bla\user@example.com"
    rlm_realm: Found realm "bla"
    rlm_realm: Adding Stripped-User-Name = "user@example.com"
    rlm_realm: Proxying request from user user@example.com to realm bla
    rlm_realm: Adding Realm = "bla"
    rlm_realm: Authentication realm is LOCAL.
++[ntdomain] returns noop
  rlm_eap: EAP packet type response id 3 length 6
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
    users: Matched entry DEFAULT at line 226
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
+- entering group authenticate
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/tls
  rlm_eap: processing type tls
  rlm_eap_tls: Authenticate
  rlm_eap_tls: processing TLS
rlm_eap_tls: Received EAP-TLS ACK message
  rlm_eap_tls: ack handshake fragment handler
  eaptls_verify returned 1 
  eaptls_process returned 13 
++[eap] returns handled
Sending Access-Challenge of id 146 to 192.168.0.8 port 1128
	EAP-Message = [payload removed: 242 characters]
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xd855ce66db51c3db82f4be0093fad79e
Finished request 3.
Going to the next request
Waking up in 0.6 seconds. 
rad_recv: Access-Request packet from host 192.168.0.8 port 1128, id=147, length=1702
	Message-Authenticator = 0x30b4960c3f45725d88c1be80642953a8
	Service-Type = Framed-User
	User-Name = "bla\\user@example.com"
	Framed-MTU = 1488
	State = 0xd855ce66db51c3db82f4be0093fad79e
	Called-Station-Id = "000FB5BA4F59:Flugplatz"
	Calling-Station-Id = "00127946D8F2"
	NAS-Identifier = "AP-Tower"
	NAS-Port-Type = Wireless-802.11
	Connect-Info = "CONNECT 11Mbps 802.11b"
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 508 characters]
	EAP-Message = [payload removed: 464 characters]
	NAS-IP-Address = 192.168.0.8
	NAS-Port = 2
	NAS-Port-Id = "STA port # 2"
+- entering group authorize
++[preprocess] returns ok
	expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
	expand: %t -> Tue Feb  5 22:55:03 2008
++[auth_log] returns ok
    rlm_realm: Looking up realm "bla" for User-Name = "bla\user@example.com"
    rlm_realm: Found realm "bla"
    rlm_realm: Adding Stripped-User-Name = "user@example.com"
    rlm_realm: Proxying request from user user@example.com to realm bla
    rlm_realm: Adding Realm = "bla"
    rlm_realm: Authentication realm is LOCAL.
++[ntdomain] returns noop
  rlm_eap: EAP packet type response id 4 length 253
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
    users: Matched entry DEFAULT at line 226
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
+- entering group authenticate
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/tls
  rlm_eap: processing type tls
  rlm_eap_tls: Authenticate
  rlm_eap_tls: processing TLS
  TLS Length 1505
rlm_eap_tls:  Received EAP-TLS First Fragment of the message
  eaptls_verify returned 9 
  eaptls_process returned 13 
++[eap] returns handled
Sending Access-Challenge of id 147 to 192.168.0.8 port 1128
	EAP-Message = 0x010500060d00
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0xd855ce66dc50c3db82f4be0093fad79e
Finished request 4.
Going to the next request
Waking up in 0.3 seconds. 
rad_recv: Access-Request packet from host 192.168.0.8 port 1128, id=148, length=221
	Message-Authenticator = 0x7d627a7897faed5ff31c3dd65eb009b5
	Service-Type = Framed-User
	User-Name = "bla\\user@example.com"
	Framed-MTU = 1488
	State = 0xd855ce66dc50c3db82f4be0093fad79e
	Called-Station-Id = "000FB5BA4F59:Flugplatz"
	Calling-Station-Id = "00127946D8F2"
	NAS-Identifier = "AP-Tower"
	NAS-Port-Type = Wireless-802.11
	Connect-Info = "CONNECT 11Mbps 802.11b"
	EAP-Message = 0x020500190d00112d679a5282e10a85aafb50657bc8b89651c0
	NAS-IP-Address = 192.168.0.8
	NAS-Port = 2
	NAS-Port-Id = "STA port # 2"
+- entering group authorize
++[preprocess] returns ok
	expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.8/auth-detail-20080205
	expand: %t -> Tue Feb  5 22:55:03 2008
++[auth_log] returns ok
    rlm_realm: Looking up realm "bla" for User-Name = "bla\user@example.com"
    rlm_realm: Found realm "bla"
    rlm_realm: Adding Stripped-User-Name = "user@example.com"
    rlm_realm: Proxying request from user user@example.com to realm bla
    rlm_realm: Adding Realm = "bla"
    rlm_realm: Authentication realm is LOCAL.
++[ntdomain] returns noop
  rlm_eap: EAP packet type response id 5 length 25
  rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
    users: Matched entry DEFAULT at line 226
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
  rad_check_password:  Found Auth-Type EAP
auth: type "EAP"
+- entering group authenticate
  rlm_eap: Request found, released from the list
  rlm_eap: EAP/tls
  rlm_eap: processing type tls
  rlm_eap_tls: Authenticate
  rlm_eap_tls: processing TLS
  eaptls_verify returned 7 
  rlm_eap_tls: Done initial handshake
  rlm_eap_tls: <<< TLS 1.0 Handshake [length 03a5], Certificate  
chain-depth=1, 
error=0
--> User-Name = bla\user@example.com
--> BUF-Name = Example Certificate Authority
--> subject = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin@example.com/CN=Example Certificate Authority
--> issuer  = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin@example.com/CN=Example Certificate Authority
--> verify return:1
	expand: %{User-Name} -> bla\user@example.com
    rlm_eap_tls: checking certificate CN (user@example.com) with xlat'ed value (bla\user@example.com)
rlm_eap_tls: Certificate CN (user@example.com) does not match specified value (bla\user@example.com)!
chain-depth=0, 
error=0
--> User-Name = bla\user@example.com
--> BUF-Name = user@example.com
--> subject = /C=FR/ST=Radius/O=Example Inc./CN=user@example.com/emailAddress=user@example.com
--> issuer  = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin@example.com/CN=Example Certificate Authority
--> verify return:0
  rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal certificate_unknown  
TLS Alert write:fatal:certificate unknown 
    TLS_accept:error in SSLv3 read client certificate B 
rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
  eaptls_process returned 13 
  rlm_eap: Freeing handler
++[eap] returns reject
auth: Failed to validate the user.
Login incorrect: [bla\\user@example.com/<via Auth-Type = EAP>] (from client AP-Tower port 2 cli 00127946D8F2)
  Found Post-Auth-Type Reject
+- entering group REJECT
++- group REJECT returns noop
Delaying reject of request 5 for 1 seconds
Going to the next request
Waking up in 0.3 seconds. 
Waking up in 0.1 seconds. 
Waking up in 0.1 seconds. 
Waking up in 0.2 seconds. 
rad_recv: Access-Request packet from host 192.168.0.8 port 1128, id=148, length=221
Waiting to send Access-Reject to client AP-Tower port 1128 - ID: 148
Sending delayed reject for request 5
Sending Access-Reject of id 148 to 192.168.0.8 port 1128
	EAP-Message = 0x04050004
	Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.3 seconds. 
Cleaning up request 0 ID 143 with timestamp +25
Waking up in 0.1 seconds. 
Cleaning up request 1 ID 144 with timestamp +25
Cleaning up request 2 ID 145 with timestamp +26
Waking up in 0.1 seconds. 
Cleaning up request 3 ID 146 with timestamp +26
Waking up in 0.2 seconds. 
Cleaning up request 4 ID 147 with timestamp +26
Waking up in 1.0 seconds. 
Cleaning up request 5 ID 148 with timestamp +26
Ready to process requests.
