<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><div>Thank you Sergio for your answer.<br><br><br>
- windows says too that one of the certificate authority seems to not
be able to deliver certificate or can't be used as final entity...<br>so, I tried what you said: install Server.p12 as intermediate CAr, without resolving the problem.<br><br>i will try to make my own certs and see. thanks!<br><br>-----<br><br>> <br>I had the same problem. The fact is that server is an intermediate <br>authotity and, using internet explorer, you need to install server.p12 <br>into intermediate trusted ca containeer. Also check validity period <br>(begining date). I had to change windows date to next day, but I don't <br>remember why. Finally I made my own ca because default radius PKI was <br>confusing me, and I used mi ca private key to sign client.*<br>I hope that this help you.<br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></div><div style="font-family: times new roman,new york,times,serif; font-size:
12pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;">----- Message d'origine ----<br>De : Sergio <sergioyebenes@alumnos.upm.es><br>À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br>Envoyé le : Dimanche, 13 Juillet 2008, 16h09mn 34s<br>Objet : Re: certificate client.* non valid on windows XP<br><br>Reveal MAP escribió:<br>> hi,<br>><br>> I use freeradius 2.0.5 and openSUSE 10.3<br>><br>> i ran "bootstrap" script + "make client.pem", "make.client.p12",<br>> - I imported "ca.der" on my xp laptop, located at the CA Authorithy <br>> containeer.<br>> I imported server.p12 too (just to verify the signature) and <br>> everything is Ok<br>> - But when i import client.p12, windows says me this certificated is <br>> not valid! and i dont know why.<br>><br>> I executed two commands: server.vrfy and client.vrfy, hoping their <br>> output
(below) could help.<br>><br>><br>> Thank you for helping<br>> -------------------------------------------------------------------------------------------------<br>> linux:/etc/raddb/certs # make server.vrfy<br>> openssl verify -CAfile ca.pem server.pem<br>> server.pem: OK<br>><br>><br>> make client.vrfy<br>> openssl pkcs12 -export -in server.crt -inkey server.key -out <br>> server.p12 -passin pass:`grep output_password server.cnf | sed <br>> 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | <br>> sed 's/.*=//;s/^ *//'`<br>> openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep <br>> output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout <br>> pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'`<br>> MAC verified OK<br>> openssl pkcs12 -export -in client.crt -inkey client.key -out <br>> client.p12 -passin pass:`grep output_password
client.cnf | sed <br>> 's/.*=//;s/^ *//'` -passout pass:`grep output_password client.cnf | <br>> sed 's/.*=//;s/^ *//'`<br>> openssl pkcs12 -in client.p12 -out client.pem -passin pass:`grep <br>> output_password client.cnf | sed 's/.*=//;s/^ *//'` -passout <br>> pass:`grep output_password client.cnf | sed 's/.*=//;s/^ *//'`<br>> MAC verified OK<br>> cp client.pem `grep emailAddress client.cnf | grep '@' | sed <br>> 's/.*=//;s/^ *//'`.pem<br>> c_rehash .<br>> Doing .<br>> 02.pem => eee97f35.0<br>> WARNING: Skipping duplicate certificate <a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a><br>> client.pem => 583a9f4b.0<br>> 01.pem => dcd1729a.0<br>> WARNING: Skipping duplicate certificate <a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a><br>> server.pem => dcd1729a.1<br>> WARNING: Skipping
duplicate certificate 03.pem<br>> WARNING: Skipping duplicate certificate 04.pem<br>> ca.pem => 23537b55.0<br>> openssl verify -CApath . client.pem<br>> client.pem: OK<br>><br>> ------------------------------------------------------------------------<br>> Envoyé avec Yahoo! Mail <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> Une boite mail plus intelligente.<br>><br>> __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>><br>> Este mensaje ha sido analizado con NOD32 antivirus system<br>> <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>>
------------------------------------------------------------------------<br>><br>> -<br>> List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>><br>><br>> __________ Información de NOD32, revisión 3263 (20080711) __________<br>><br>> Este mensaje ha sido analizado con NOD32 antivirus system<br>> <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br><br><a href="http://www.freeradius.org/list/users.html" target="_blank"></a></div></div></div><br>
<hr size="1">
Envoyé avec <a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html">Yahoo! Mail</a>.<br>Une boite mail plus intelligente. </a></body></html>