<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><div>Thanx for your help Sergio, but it is exactly the same!! <img src="http://mail.yimg.com/us.yimg.com/i/mesg/tsmileys2/02.gif"> it doesn't work.<br></div><div style="font-family: times new roman,new york,times,serif; font-size: 12pt;"><br><div style="font-family: arial,helvetica,sans-serif; font-size: 13px;">----- Message d'origine ----<br>De : Sergio <sergioyebenes@alumnos.upm.es><br>À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br>Envoyé le : Dimanche, 13 Juillet 2008, 18h51mn 41s<br>Objet : Re : certificate client.* non valid on windows XP<br><br>Reveal MAP escribió:<br>> Installing ca.der, server.crt and client.crt, i obtain exactly the <br>> same result!!<br>><br>> ----- Message d'origine ----<br>> De : Sergio <<a
ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a>><br>> À : FreeRadius users mailing list <<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>> Envoyé le : Dimanche, 13 Juillet 2008, 16h59mn 38s<br>> Objet : Re: Re : certificate client.* non valid on windows XP<br>><br>> Reveal MAP escribió:<br>> > Thank you Sergio for your answer.<br>> ><br>> ><br>> > - windows says too that one of the certificate authority seems to not<br>> > be able to deliver certificate or can't be used as final entity...<br>> > so, I tried what you said: install Server.p12 as intermediate CAr,<br>> > without resolving the problem.<br>> ><br>> > i will try to make my own certs and see. thanks!<br>> ><br>> >
-----<br>> ><br>> > ><br>> > I had the same problem. The fact is that server is an intermediate<br>> > authotity and, using internet explorer, you need to install server.p12<br>> > into intermediate trusted ca containeer. Also check validity period<br>> > (begining date). I had to change windows date to next day, but I don't<br>> > remember why. Finally I made my own ca because default radius PKI was<br>> > confusing me, and I used mi ca private key to sign client.*<br>> > I hope that this help you.<br>> > -<br>> > List info/subscribe/unsubscribe? See<br>> > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> ><br>> > ----- Message d'origine ----<br>> > De : Sergio <<a ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a>
<br>> <mailto:<a ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a>>><br>> > À : FreeRadius users mailing list <br>> <<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a> <br>> <mailto:<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>>><br>> > Envoyé le : Dimanche, 13 Juillet 2008, 16h09mn 34s<br>> > Objet : Re: certificate client.* non valid on windows XP<br>> ><br>> > Reveal MAP escribió:<br>> > > hi,<br>> > ><br>> > > I use freeradius 2.0.5 and openSUSE 10.3<br>> > ><br>> > > i ran "bootstrap" script + "make client.pem", "make.client.p12",<br>> > > - I imported
"ca.der" on my xp laptop, located at the CA Authorithy<br>> > > containeer.<br>> > > I imported server.p12 too (just to verify the signature) and<br>> > > everything is Ok<br>> > > - But when i import client.p12, windows says me this certificated is<br>> > > not valid! and i dont know why.<br>> > ><br>> > > I executed two commands: server.vrfy and client.vrfy, hoping their<br>> > > output (below) could help.<br>> > ><br>> > ><br>> > > Thank you for helping<br>> > ><br>> > <br>> -------------------------------------------------------------------------------------------------<br>> > > linux:/etc/raddb/certs # make server.vrfy<br>> > > openssl verify -CAfile ca.pem server.pem<br>> > > server.pem: OK<br>> > ><br>> > ><br>> > > make client.vrfy<br>> > > openssl pkcs12 -export -in
server.crt -inkey server.key -out<br>> > > server.p12 -passin pass:`grep output_password server.cnf | sed<br>> > > 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf |<br>> > > sed 's/.*=//;s/^ *//'`<br>> > > openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep<br>> > > output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout<br>> > > pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'`<br>> > > MAC verified OK<br>> > > openssl pkcs12 -export -in client.crt -inkey client.key -out<br>> > > client.p12 -passin pass:`grep output_password client.cnf | sed<br>> > > 's/.*=//;s/^ *//'` -passout pass:`grep output_password client.cnf |<br>> > > sed 's/.*=//;s/^ *//'`<br>> > > openssl pkcs12 -in client.p12 -out client.pem -passin pass:`grep<br>> > > output_password client.cnf | sed 's/.*=//;s/^
*//'` -passout<br>> > > pass:`grep output_password client.cnf | sed 's/.*=//;s/^ *//'`<br>> > > MAC verified OK<br>> > > cp client.pem `grep emailAddress client.cnf | grep '@' | sed<br>> > > 's/.*=//;s/^ *//'`.pem<br>> > > c_rehash .<br>> > > Doing .<br>> > > 02.pem => eee97f35.0<br>> > > WARNING: Skipping duplicate certificate <a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a> <br>> <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a>><br>> > <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a> <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a>>><br>> > > client.pem => 583a9f4b.0<br>> > > 01.pem =>
dcd1729a.0<br>> > > WARNING: Skipping duplicate certificate <a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a> <br>> <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a>><br>> > <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a> <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a>>><br>> > > server.pem => dcd1729a.1<br>> > > WARNING: Skipping duplicate certificate 03.pem<br>> > > WARNING: Skipping duplicate certificate 04.pem<br>> > > ca.pem => 23537b55.0<br>> > > openssl verify -CApath . client.pem<br>> > > client.pem: OK<br>> > ><br>> > > <br>>
------------------------------------------------------------------------<br>> > > Envoyé avec Yahoo! Mail<br>> > ><br>> > <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> > > Une boite mail plus intelligente.<br>> > ><br>> > > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>> > ><br>> > > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > > <br>> ------------------------------------------------------------------------<br>> > ><br>> > > -<br>> > >
List info/subscribe/unsubscribe? See<br>> > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> > ><br>> > ><br>> > > __________ Información de NOD32, revisión 3263 (20080711) __________<br>> > ><br>> > > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> ><br>> ><br>> > ------------------------------------------------------------------------<br>> > Envoyé avec Yahoo! Mail<br>> > <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>>
> Une boite mail plus intelligente.<br>> ><br>> > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>> ><br>> > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > ------------------------------------------------------------------------<br>> ><br>> > -<br>> > List info/subscribe/unsubscribe? See <br>> <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> ><br>> ><br>> > __________ Información de NOD32, revisión 3263 (20080711) __________<br>> ><br>> > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > <br>> Try to install server.cer, not server.p12 into intermediate
containeer.<br>> open client cert with IE and see certification route. If you can see the<br>> 3 level route but client cert isn't ok, check dates. I'm sure this works.<br>> -<br>> List info/subscribe/unsubscribe? See <br>> <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>><br>> ------------------------------------------------------------------------<br>> Envoyé avec Yahoo! Mail <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> Une boite mail plus intelligente.<br>><br>> __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>><br>> Este mensaje ha sido
analizado con NOD32 antivirus system<br>> <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> ------------------------------------------------------------------------<br>><br>> -<br>> List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>><br>><br>> __________ Información de NOD32, revisión 3263 (20080711) __________<br>><br>> Este mensaje ha sido analizado con NOD32 antivirus system<br>> <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> <br>If you install client.crt you only have installed client public key. DER<br>format (crt, cer, der) usually contains only public key. p12 format<br>contains public and private key. Because of this, and because server is<br>your signer, you should install ca.der, server.crt and client.p12 into<br>root, intermediate, and
personal containeers, respectively and with this<br>order to be sure.<br><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a></div></div></div><br>
<hr size="1">
Envoyé avec <a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html">Yahoo! Mail</a>.<br>Une boite mail plus intelligente. </a></body></html>