<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><div>Installing ca.der, server.crt and client.crt, i obtain exactly the same result!!<br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;">----- Message d'origine ----<br>De : Sergio <sergioyebenes@alumnos.upm.es><br>À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br>Envoyé le : Dimanche, 13 Juillet 2008, 16h59mn 38s<br>Objet : Re: Re : certificate client.* non valid on windows XP<br><br>Reveal MAP escribió:<br>> Thank you Sergio for your answer.<br>><br>><br>> - windows says too that one of the certificate authority seems to not <br>> be able to deliver certificate or can't be used as final entity...<br>> so, I tried what
you said: install Server.p12 as intermediate CAr, <br>> without resolving the problem.<br>><br>> i will try to make my own certs and see. thanks!<br>><br>> -----<br>><br>> > <br>> I had the same problem. The fact is that server is an intermediate<br>> authotity and, using internet explorer, you need to install server.p12<br>> into intermediate trusted ca containeer. Also check validity period<br>> (begining date). I had to change windows date to next day, but I don't<br>> remember why. Finally I made my own ca because default radius PKI was<br>> confusing me, and I used mi ca private key to sign client.*<br>> I hope that this help you.<br>> -<br>> List info/subscribe/unsubscribe? See <br>> <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>><br>> ----- Message d'origine ----<br>> De : Sergio <<a
ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a>><br>> À : FreeRadius users mailing list <<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>> Envoyé le : Dimanche, 13 Juillet 2008, 16h09mn 34s<br>> Objet : Re: certificate client.* non valid on windows XP<br>><br>> Reveal MAP escribió:<br>> > hi,<br>> ><br>> > I use freeradius 2.0.5 and openSUSE 10.3<br>> ><br>> > i ran "bootstrap" script + "make client.pem", "make.client.p12",<br>> > - I imported "ca.der" on my xp laptop, located at the CA Authorithy<br>> > containeer.<br>> > I imported server.p12 too (just to verify the signature) and<br>> > everything is Ok<br>> > - But when i import client.p12, windows says me this certificated is <br>>
> not valid! and i dont know why.<br>> ><br>> > I executed two commands: server.vrfy and client.vrfy, hoping their<br>> > output (below) could help.<br>> ><br>> ><br>> > Thank you for helping<br>> > <br>> -------------------------------------------------------------------------------------------------<br>> > linux:/etc/raddb/certs # make server.vrfy<br>> > openssl verify -CAfile ca.pem server.pem<br>> > server.pem: OK<br>> ><br>> ><br>> > make client.vrfy<br>> > openssl pkcs12 -export -in server.crt -inkey server.key -out<br>> > server.p12 -passin pass:`grep output_password server.cnf | sed<br>> > 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf |<br>> > sed 's/.*=//;s/^ *//'`<br>> > openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep<br>> > output_password server.cnf | sed 's/.*=//;s/^ *//'`
-passout<br>> > pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'`<br>> > MAC verified OK<br>> > openssl pkcs12 -export -in client.crt -inkey client.key -out<br>> > client.p12 -passin pass:`grep output_password client.cnf | sed<br>> > 's/.*=//;s/^ *//'` -passout pass:`grep output_password client.cnf |<br>> > sed 's/.*=//;s/^ *//'`<br>> > openssl pkcs12 -in client.p12 -out client.pem -passin pass:`grep<br>> > output_password client.cnf | sed 's/.*=//;s/^ *//'` -passout<br>> > pass:`grep output_password client.cnf | sed 's/.*=//;s/^ *//'`<br>> > MAC verified OK<br>> > cp client.pem `grep emailAddress client.cnf | grep '@' | sed<br>> > 's/.*=//;s/^ *//'`.pem<br>> > c_rehash .<br>> > Doing .<br>> > 02.pem => eee97f35.0<br>> > WARNING: Skipping duplicate certificate <a ymailto="mailto:user@example.com.pem"
href="mailto:user@example.com.pem">user@example.com.pem</a> <br>> <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a>><br>> > client.pem => 583a9f4b.0<br>> > 01.pem => dcd1729a.0<br>> > WARNING: Skipping duplicate certificate <a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a> <br>> <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a>><br>> > server.pem => dcd1729a.1<br>> > WARNING: Skipping duplicate certificate 03.pem<br>> > WARNING: Skipping duplicate certificate 04.pem<br>> > ca.pem => 23537b55.0<br>> > openssl verify -CApath . client.pem<br>> > client.pem: OK<br>> ><br>> > ------------------------------------------------------------------------<br>> > Envoyé avec Yahoo! Mail<br>>
> <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> > Une boite mail plus intelligente.<br>> ><br>> > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>> ><br>> > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > ------------------------------------------------------------------------<br>> ><br>> > -<br>> > List info/subscribe/unsubscribe? See <br>> <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> ><br>> ><br>> >
__________ Información de NOD32, revisión 3263 (20080711) __________<br>> ><br>> > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>><br>><br>> ------------------------------------------------------------------------<br>> Envoyé avec Yahoo! Mail <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> Une boite mail plus intelligente.<br>><br>> __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>><br>> Este mensaje ha sido analizado con NOD32 antivirus system<br>> <a href="http://www.nod32.com"
target="_blank">http://www.nod32.com</a><br>> ------------------------------------------------------------------------<br>><br>> -<br>> List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>><br>><br>> __________ Información de NOD32, revisión 3263 (20080711) __________<br>><br>> Este mensaje ha sido analizado con NOD32 antivirus system<br>> <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> <br>Try to install server.cer, not server.p12 into intermediate containeer. <br>open client cert with IE and see certification route. If you can see the <br>3 level route but client cert isn't ok, check dates. I'm sure this works.<br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html"
target="_blank">http://www.freeradius.org/list/users.html</a></div></div></div><br>
<hr size="1">
Envoyé avec <a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html">Yahoo! Mail</a>.<br>Une boite mail plus intelligente. </a></body></html>