<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:garamond,new york,times,serif;font-size:12pt">Thanx a lot guy!<br><br>I tried to create my own certificate (that i didn't verify), but i still encounter a problem generating the client certificate: the key file and and the .912 file are empty and i don't know why. (size 0 kb), and it gives no error message!!<br><br>i will try the scripts you gave me...<br><br>mine are below and could be have a mistake on cleints lines:<br><br>-------------------------------------------------------------------------------------------------------------<br>-------------------------------------------------------------------------------------------------------------<br><pre>######################################################################<br>#<br># Create a new self-signed CA
certificate<br>#<br>######################################################################<br># cakey.pem, cacert.pem:<br> openssl req -new -x509 -keyout /etc/raddb/Md5CA/Private/cakey.pem -out /etc/raddb/Md5CA/cacert.pem -config /etc/raddb/Md5CA/conf/ca.cnf<br><br>ca.der: ca.pem<br> openssl x509 -inform PEM -outform DER -in /etc/raddb/Md5CA/cacert.pem -out /etc/raddb/Md5CA/cacert.der<br><br>######################################################################<br><br><br><br><br># requete de cerificat server<br><br> openssl req -newkey rsa:1024 -keyout /etc/raddb/Md5CA/keys/radiusserver2_key.pem -out /etc/raddb/Md5CA/req/radiusserver2_cert.req -config /etc/raddb/Md5CA/conf/server.cnf<br><br><br># Signature du certificat server<br><br> openssl ca -out /etc/raddb/Md5CA/certs/radiusserver2_cert.pem -extensions xpserver_ext -extfile /etc/ssl/xpextensions -infiles
/etc/raddb/Md5CA/req/radiusserver2_cert.req<br><br>===================================================================================<br>======================================================================================================================================================================<br><br># requete de cerificat client<br><br> #openssl req -new -nodes -keyout /etc/raddb/Md5CA/keys/toutou_key.pem -out /etc/raddb/Md5CA/req/toutou_cert.req<br> openssl req -newkey rsa:1024 -keyout /etc/raddb/Md5CA/keys/toutou_key.pem -out /etc/raddb/Md5CA/req/toutou_cert.req -config /etc/raddb/Md5CA/conf/client.cnf<br><br># Signature du certificat client<br><br> openssl ca -out /etc/raddb/certs/Md5CA/certs/toutou_cert.pem -extensions xpclient_ext -extfile /etc/ssl/xpextensions -infiles /etc/raddb/Md5CA/req/toutou_cert.req<br><br># conversion du certificat client au format pkcs12<br><br> openssl pkcs12 -export -in /etc/raddb/Md5CA/certs/toutou_cert.pem
-inkey /etc/raddb/Md5CA/key/toutou_key.pem -out /etc/raddb/Md5CA/certs/p12s/toutou_certs.p12 -clcerts<br><br><br><br><br>######################################################################<br>#<br># Miscellaneous rules.<br>#<br>######################################################################<br>index.txt:<br> @touch index.txt<br><br>serial:<br> @echo '01' > serial<br><br>random:<br> @if [ -e /dev/urandom ] ; then \<br> dd if=/dev/urandom of=./random count=10 >/dev/null 2>&1; \<br> else \<br> date > ./random; \<br> fi<br><br>print:<br> openssl x509 -text -in server.crt<br><br>printca:<br> openssl x509 -text -in ca.pem<br><br>clean:<br> @rm -f *~ *old client.csr client.key client.crt client.p12 client.pem<br><br>#<br># Run distclean ONLY if there's a CVS directory, AND it points to<br># cvs.freeradius.org. Otherwise, it would be easy for administrators<br># to type "make distclean", and destroy their CA and server
certificates.<br>#<br>distclean:<br> @if [ -d CVS -a `grep -i 'cvs\.freeradius\.org' CVS/Root` ] ; then \<br> rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \<br> serial* random *\.0 *\.1; \<br> fi<br></pre><br><br><div> </div><p><strong><font color="#8080ff">MBA OYONE Joël<br></font></strong><font color="#8080ff" size="2"><em>Lot. El Firdaous<br>Bât GH20, Porte A 204, Appt 8<br>20000 Oulfa<br>Casablanca - Maroc</em></font></p><p><em><font color="#8080ff" size="2"></font></em> </p><p><em><font color="#8080ff" size="2">Tél. : +212 69 25 85 70</font></em></p><div><br></div><div style="font-family: garamond,new york,times,serif; font-size: 12pt;"><br><div style="font-family: garamond,new york,times,serif; font-size: 10pt;">----- Message d'origine ----<br>De : Sergio <sergioyebenes@alumnos.upm.es><br>À : FreeRadius users mailing list <freeradius-users@lists.freeradius.org><br>Envoyé le : Lundi, 14 Juillet 2008,
21h50mn 42s<br>Objet : Re : certificate client.* non valid on windows XP<br><br>Reveal MAP escribió:<br>> Thanx for your help Sergio, but it is exactly the same!! it doesn't work.<br>><br>> ----- Message d'origine ----<br>> De : Sergio <<a ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a>><br>> À : FreeRadius users mailing list <<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>> Envoyé le : Dimanche, 13 Juillet 2008, 18h51mn 41s<br>> Objet : Re : certificate client.* non valid on windows XP<br>><br>> Reveal MAP escribió:<br>> > Installing ca.der, server.crt and client.crt, i obtain exactly the<br>> > same result!!<br>> ><br>> > ----- Message d'origine ----<br>> > De : Sergio <<a
ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a> <br>> <mailto:<a ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a>>><br>> > À : FreeRadius users mailing list <br>> <<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a> <br>> <mailto:<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>>><br>> > Envoyé le : Dimanche, 13 Juillet 2008, 16h59mn 38s<br>> > Objet : Re: Re : certificate client.* non valid on windows XP<br>> ><br>> > Reveal MAP escribió:<br>> > > Thank you Sergio for your answer.<br>> > ><br>> > ><br>> > > -
windows says too that one of the certificate authority seems to not<br>> > > be able to deliver certificate or can't be used as final entity...<br>> > > so, I tried what you said: install Server.p12 as intermediate CAr,<br>> > > without resolving the problem.<br>> > ><br>> > > i will try to make my own certs and see. thanks!<br>> > ><br>> > > -----<br>> > ><br>> > > ><br>> > > I had the same problem. The fact is that server is an intermediate<br>> > > authotity and, using internet explorer, you need to install server.p12<br>> > > into intermediate trusted ca containeer. Also check validity period<br>> > > (begining date). I had to change windows date to next day, but I don't<br>> > > remember why. Finally I made my own ca because default radius PKI was<br>> > > confusing me, and I used mi ca private key to sign
client.*<br>> > > I hope that this help you.<br>> > > -<br>> > > List info/subscribe/unsubscribe? See<br>> > > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> > ><br>> > > ----- Message d'origine ----<br>> > > De : Sergio <<a ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a> <br>> <mailto:<a ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a>><br>> > <mailto:<a ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a> <br>> <mailto:<a ymailto="mailto:sergioyebenes@alumnos.upm.es" href="mailto:sergioyebenes@alumnos.upm.es">sergioyebenes@alumnos.upm.es</a>>>><br>> > > À :
FreeRadius users mailing list<br>> > <<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a> <br>> <mailto:<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>><br>> > <mailto:<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a> <br>> <mailto:<a ymailto="mailto:freeradius-users@lists.freeradius.org" href="mailto:freeradius-users@lists.freeradius.org">freeradius-users@lists.freeradius.org</a>>>><br>> > > Envoyé le : Dimanche, 13 Juillet 2008, 16h09mn 34s<br>> > > Objet : Re: certificate client.* non valid on windows XP<br>> > ><br>> > > Reveal MAP escribió:<br>> > > >
hi,<br>> > > ><br>> > > > I use freeradius 2.0.5 and openSUSE 10.3<br>> > > ><br>> > > > i ran "bootstrap" script + "make client.pem", "make.client.p12",<br>> > > > - I imported "ca.der" on my xp laptop, located at the CA Authorithy<br>> > > > containeer.<br>> > > > I imported server.p12 too (just to verify the signature) and<br>> > > > everything is Ok<br>> > > > - But when i import client.p12, windows says me this certificated is<br>> > > > not valid! and i dont know why.<br>> > > ><br>> > > > I executed two commands: server.vrfy and client.vrfy, hoping their<br>> > > > output (below) could help.<br>> > > ><br>> > > ><br>> > > > Thank you for helping<br>> > > ><br>> > ><br>> > <br>>
-------------------------------------------------------------------------------------------------<br>> > > > linux:/etc/raddb/certs # make server.vrfy<br>> > > > openssl verify -CAfile ca.pem server.pem<br>> > > > server.pem: OK<br>> > > ><br>> > > ><br>> > > > make client.vrfy<br>> > > > openssl pkcs12 -export -in server.crt -inkey server.key -out<br>> > > > server.p12 -passin pass:`grep output_password server.cnf | sed<br>> > > > 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf |<br>> > > > sed 's/.*=//;s/^ *//'`<br>> > > > openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep<br>> > > > output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout<br>> > > > pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'`<br>> > > > MAC verified
OK<br>> > > > openssl pkcs12 -export -in client.crt -inkey client.key -out<br>> > > > client.p12 -passin pass:`grep output_password client.cnf | sed<br>> > > > 's/.*=//;s/^ *//'` -passout pass:`grep output_password client.cnf |<br>> > > > sed 's/.*=//;s/^ *//'`<br>> > > > openssl pkcs12 -in client.p12 -out client.pem -passin pass:`grep<br>> > > > output_password client.cnf | sed 's/.*=//;s/^ *//'` -passout<br>> > > > pass:`grep output_password client.cnf | sed 's/.*=//;s/^ *//'`<br>> > > > MAC verified OK<br>> > > > cp client.pem `grep emailAddress client.cnf | grep '@' | sed<br>> > > > 's/.*=//;s/^ *//'`.pem<br>> > > > c_rehash .<br>> > > > Doing .<br>> > > > 02.pem => eee97f35.0<br>> > > > WARNING: Skipping duplicate certificate <a ymailto="mailto:user@example.com.pem"
href="mailto:user@example.com.pem">user@example.com.pem</a> <br>> <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a>><br>> > <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a> <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a>>><br>> > > <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a> <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a>> <br>> <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a> <mailto:<a ymailto="mailto:user@example.com.pem" href="mailto:user@example.com.pem">user@example.com.pem</a>>>><br>> > > > client.pem =>
583a9f4b.0<br>> > > > 01.pem => dcd1729a.0<br>> > > > WARNING: Skipping duplicate certificate <a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a> <br>> <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a>><br>> > <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a> <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a>>><br>> > > <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a> <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a>> <br>> <mailto:<a ymailto="mailto:user2@example.com.pem"
href="mailto:user2@example.com.pem">user2@example.com.pem</a> <mailto:<a ymailto="mailto:user2@example.com.pem" href="mailto:user2@example.com.pem">user2@example.com.pem</a>>>><br>> > > > server.pem => dcd1729a.1<br>> > > > WARNING: Skipping duplicate certificate 03.pem<br>> > > > WARNING: Skipping duplicate certificate 04.pem<br>> > > > ca.pem => 23537b55.0<br>> > > > openssl verify -CApath . client.pem<br>> > > > client.pem: OK<br>> > > ><br>> > > ><br>> > ------------------------------------------------------------------------<br>> > > > Envoyé avec Yahoo! Mail<br>> > > ><br>> > ><br>> > <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html"
target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> > > > Une boite mail plus intelligente.<br>> > > ><br>> > > > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>> > > ><br>> > > > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > > > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > > ><br>> > ------------------------------------------------------------------------<br>> > > ><br>> > > > -<br>> > > > List info/subscribe/unsubscribe? See<br>> > > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> > > ><br>> > > ><br>> > > > __________
Información de NOD32, revisión 3263 (20080711) __________<br>> > > ><br>> > > > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > > > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > ><br>> > ><br>> > > <br>> ------------------------------------------------------------------------<br>> > > Envoyé avec Yahoo! Mail<br>> > ><br>> > <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> > > Une boite mail plus intelligente.<br>> > ><br>> > > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>> >
><br>> > > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > > <br>> ------------------------------------------------------------------------<br>> > ><br>> > > -<br>> > > List info/subscribe/unsubscribe? See<br>> > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> > ><br>> > ><br>> > > __________ Información de NOD32, revisión 3263 (20080711) __________<br>> > ><br>> > > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > ><br>> > Try to install server.cer, not server.p12 into intermediate containeer.<br>> > open client cert with IE and see certification
route. If you can see the<br>> > 3 level route but client cert isn't ok, check dates. I'm sure this <br>> works.<br>> > -<br>> > List info/subscribe/unsubscribe? See<br>> > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> ><br>> > ------------------------------------------------------------------------<br>> > Envoyé avec Yahoo! Mail<br>> > <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> > Une boite mail plus intelligente.<br>> ><br>> > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________<br>> ><br>> > Este
mensaje ha sido analizado con NOD32 antivirus system<br>> > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > ------------------------------------------------------------------------<br>> ><br>> > -<br>> > List info/subscribe/unsubscribe? See <br>> <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>> ><br>> ><br>> > __________ Información de NOD32, revisión 3263 (20080711) __________<br>> ><br>> > Este mensaje ha sido analizado con NOD32 antivirus system<br>> > <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> > <br>> If you install client.crt you only have installed client public key. DER<br>> format (crt, cer, der) usually contains only public key. p12 format<br>> contains public and private key. Because of this, and because server is<br>> your
signer, you should install ca.der, server.crt and client.p12 into<br>> root, intermediate, and personal containeers, respectively and with this<br>> order to be sure.<br>><br>> -<br>> List info/subscribe/unsubscribe? See <br>> <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>><br>> ------------------------------------------------------------------------<br>> Envoyé avec Yahoo! Mail <br>> <<a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html" target="_blank">http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html</a>>.<br>> Une boite mail plus intelligente.<br>> ------------------------------------------------------------------------<br>><br>> -<br>> List
info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>><br>><br>> __________ Información de NOD32, revisión 3263 (20080711) __________<br>><br>> Este mensaje ha sido analizado con NOD32 antivirus system<br>> <a href="http://www.nod32.com" target="_blank">http://www.nod32.com</a><br>> <br>I think it can be Extended Key Usage field into server cert. It brings <br>client authentication and probably IE isn't clever enough. But default <br>configuration append xp extensions and should work......I don't <br>understand.......firefox hasn't got intermediate ca containeer, but it <br>installs cert into root container and recognizes the route. You can see <br>this link, it's spanish, but there are 3 shell scripts, commented in <br>english, to build all the pki. be carefully with demoCA/ dir.<br><a
href="http://www.blyx.com/public/wireless/wpa+eap-tls+radius/hotwo-wpa+eap-tls+freeradius.pdf" target="_blank">http://www.blyx.com/public/wireless/wpa+eap-tls+radius/hotwo-wpa+eap-tls+freeradius.pdf</a><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a></div></div></div><br>
<hr size="1">
Envoyé avec <a href="http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/evt=52423/*http://fr.docs.yahoo.com/mail/overview/index.html">Yahoo! Mail</a>.<br>Une boite mail plus intelligente. </a></body></html>