<div>Hi All</div>
<div> </div>
<div>An update: I tried using OpenSSL version 9.8c, </div>
<div>but got exact same issues.</div>
<div> </div>
<div> </div>
<div>Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: Done initial handshake<br>Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake<br>[length 038d], Certificate<br>Wed May 21 19:31:19 2008 : *Error: --> verify error:num=20:unable to get<br>
local issuer certificate*<br>Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Alert [length<br>0002], fatal unknown_ca<br>Wed May 21 19:31:19 2008 : Error: TLS Alert write:fatal:unknown CA<br>Wed May 21 19:31:19 2008 : Error: TLS_accept:error in SSLv3 read client<br>
certificate B<br>Wed May 21 19:31:19 2008 : Error: rlm_eap: SS L error error:140890B2:SSL<br>routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned<br>Wed May 21 19:31:19 2008 : Error: rlm_eap_tls: SSL_read failed in a system<br>
call (-1), TLS session fails.<br>Wed May 21 19:31:19 2008 : Debug: eaptls_process returned 13</div>
<div> </div>
<div>On OpenSSL 9.8g, radiusd started giving </div>
<div>segmentation fault (may be it's some conflict).</div>
<div> </div>
<div>I really need a breakthrough now, I don't think </div>
<div>there is anything left that I can do now, may be</div>
<div>use some other client or sever for my purpose :)</div>
<div> </div>
<div>-</div>
<div>Naunidh</div>
<div>----------------------------------------------------------------------</div>
<p>Message: 1<br>Date: Wed, 21 May 2008 20:15:06 +0530<br>From: "Naunidh S Chadha" <<a href="mailto:naunidh@gmail.com">naunidh@gmail.com</a>><br>Subject: EAP TLS testing using eapol_test<br>To: <a href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a><br>
Message-ID:<br> <<a href="mailto:4b1838520805210745u1a014f31s79bad2914b8602fe@mail.gmail.com">4b1838520805210745u1a014f31s79bad2914b8602fe@mail.gmail.com</a>><br>Content-Type: text/plain; charset="iso-8859-1"</p>
<p>Hi All</p>
<p>I am attempting to authenticate an EAP-TLS using eapol_test tool against<br>FreeRADIUS Version <a href="http://2.0.3.">2.0.3.</a><br>>From last two days I am getting stumped by certificate issues. Currently I<br>have the following error in my<br>
Freeradius log that seems to be the problem.</p>
<p><br>Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: Done initial handshake<br>Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake<br>[length 038d], Certificate<br>Wed May 21 19:31:19 2008 : *Error: --> verify error:num=20:unable to get<br>
local issuer certificate*<br>Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Alert [length<br>0002], fatal unknown_ca<br>Wed May 21 19:31:19 2008 : Error: TLS Alert write:fatal:unknown CA<br>Wed May 21 19:31:19 2008 : Error: TLS_accept:error in SSLv3 read client<br>
certificate B<br>Wed May 21 19:31:19 2008 : Error: rlm_eap: SSL error error:140890B2:SSL<br>routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned<br>Wed May 21 19:31:19 2008 : Error: rlm_eap_tls: SSL_read failed in a system<br>
call (-1), TLS session fails.<br>Wed May 21 19:31:19 2008 : Debug: eaptls_process returned 13</p>
<p>>From searching around the net I found that one issue could be that my SSL<br>does not understand<br>that server.pem is a trusted CA. To make that happen I created hashes using<br>the following command,</p>
<p>*ln -s client.pem `openssl x509 -hash -noout 5~-in client.pem`.0*</p>
<p>for ca.pem/server.pem and client.pem. I then pasted the hashes and .pem<br>files into /usr/share/ssl/certs<br>folder too (out of desperation :) ). After this if I ran the command<br>"openssl verify *.pem" in .../raddb/certs<br>
folder, it would return OK for all pem files. IMO this is the best to test<br>that all certificates are in order.<br>I also used the command "openssl verify -CApath . *.pem" (picked it up from<br>Makefile) and it returned OK too.</p>
<p>I must add here that my setup is totally as per the docs/config file<br>explanations. The radiusd.conf is configured to<br>use EAP as per the default config, and the certs are made by running the<br>make command in raddb/certs folder.<br>
I commented out bootstrap for my exploration. I ran "make client.pem" to<br>create client certificates.</p>
<p>The supplicant client uses following configuration file:</p>
<p>network={<br> ssid="1x-test"<br> key_mgmt=WPA-EAP<br> eap=TLS<br> identity="<a href="mailto:user@example.com">user@example.com</a>"<br> ca_cert="/usr/local/etc/raddb/certs/ca.pem"<br>
client_cert="<a>/usr/local/etc/raddb/certs/user@example.com.pem</a>"<br> private_key="/usr/local/etc/raddb/certs/client.key"<br> private_key_passwd="whatever"<br> eapol_flags=3<br>
}</p>
<p><br>Since the logs are big enough to be a torture for people reading in digest<br>mode, I have put them at<br><a href="http://naunidh.googlepages.com/logs">http://naunidh.googlepages.com/logs</a></p>
<p>It has output of radiusd -XXX followed by logs of eapol_test tool.</p>
<p>My OpenSSL version is 9.7a (supported by Freeradius), My next step would be<br>to upgrade this but it does not<br>look like an OpenSSL issue, Upgrading this would be a pain at the moment as<br>lot of people are dependent on the<br>
setup, but this is the only recourse left from my side.</p>
<p>Any help would be greatly appreciated.<br>Sorry for the long mail, but I could not shorten it any more without missing<br>something important.</p>
<p>Thanks All</p>
<p>-<br>Naunidh</p>