<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=gb2312">
<META content="MSHTML 6.00.2900.5897" name=GENERATOR>
<STYLE>@font-face {
font-family: ËÎÌå;
}
@font-face {
font-family: Verdana;
}
@font-face {
font-family: @ËÎÌå;
}
@page Section1 {size: 595.3pt 841.9pt; margin: 72.0pt 90.0pt 72.0pt 90.0pt; layout-grid: 15.6pt; }
P.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; TEXT-ALIGN: justify
}
LI.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; TEXT-ALIGN: justify
}
DIV.MsoNormal {
TEXT-JUSTIFY: inter-ideograph; FONT-SIZE: 10.5pt; MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman"; TEXT-ALIGN: justify
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.EmailStyle17 {
FONT-WEIGHT: normal; COLOR: windowtext; FONT-STYLE: normal; FONT-FAMILY: Verdana; TEXT-DECORATION: none; mso-style-type: personal-compose
}
DIV.Section1 {
page: Section1
}
UNKNOWN {
FONT-SIZE: 10pt
}
BLOCKQUOTE {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
UL {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</STYLE>
</HEAD>
<BODY style="FONT-SIZE: 10pt; FONT-FAMILY: verdana">
<DIV><FONT face=Verdana color=#000080 size=2>I think you should install the
openssl-delvel package for tls header and lib, if you can not run
radiuxd -X also before</FONT> replacing the the certs.<FONT
color=#000080>and then build freeradius again.</FONT></DIV>
<DIV><FONT face=Verdana size=2>
<DIV></DIV>
<DIV>On Sun, 31 Jan 2010, Alan Buxey wrote:</DIV>
<DIV></DIV>
<DIV>> Hi,</DIV>
<DIV>></DIV>
<DIV>>> to these servers" client field, just enter the 'common name' entered on</DIV>
<DIV>>> the certificate? I wonder if a wildcard cert would work for this. As in</DIV>
<DIV>>> *.myorg.ca, then entering *.myorg.ca for client servers field. Just asking</DIV>
<DIV>>> because I have one of those.</DIV>
<DIV>></DIV>
<DIV>> depends on supplicant - some understand wildcards...some just need the</DIV>
<DIV>> domain name to be specified</DIV>
<DIV>></DIV>
<DIV>>> In the README file there is this warning:</DIV>
<DIV>>></DIV>
<DIV>>>
"You will have to ensure that the certificate contains the XP</DIV>
<DIV>>>
extensions needed by Microsoft clients."</DIV>
<DIV>>></DIV>
<DIV>>> But I can't find any further information about it. How do I ensure my</DIV>
<DIV>>> certificate has these extensions? Would a CA signed cert have this?</DIV>
<DIV>></DIV>
<DIV>> check the FreeRADIUS certificate makefile - you can see the xpextensions</DIV>
<DIV>> file and the required attributes. you can use the openssl tool to view</DIV>
<DIV>> the certificate in text mode - whethr the CA will sign it - you</DIV>
<DIV>> may have to request this functionality</DIV>
<DIV>></DIV>
<DIV></DIV>
<DIV></DIV>
<DIV>I generated a server certificate using the provided documentation in the </DIV>
<DIV>certs/README file. I took the generated server.csr and got it signed by </DIV>
<DIV>Thawte (just a 20 day trial cert for now). They provided my certificate </DIV>
<DIV>and I replaced the contents of server.crt with it. Now when I start up </DIV>
<DIV>FreeRadius in debug, I get:</DIV>
<DIV></DIV>
<DIV>rlm_eap: SSL error error:0B080074:x509 certificate </DIV>
<DIV>routines:X509_check_private_key:key values mismatch</DIV>
<DIV>rlm_eap_tls: Error reading private key file </DIV>
<DIV>/usr/local/freeradius/etc/raddb/certs/server.key</DIV>
<DIV>rlm_eap: Failed to initialize type tls</DIV>
<DIV>/usr/local/freeradius/etc/raddb/eap.conf[17]: Instantiation failed for </DIV>
<DIV>module "eap"</DIV>
<DIV>/usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to </DIV>
<DIV>find module "eap".</DIV>
<DIV>/usr/local/freeradius/etc/raddb/sites-enabled/inner-tunnel[176]: Errors </DIV>
<DIV>parsing authenticate section.</DIV>
<DIV> }</DIV>
<DIV></DIV>
<DIV>I did update the private key password in eap.conf, to match the one I used </DIV>
<DIV>in the original signing request. So what did I do wrong?</DIV>
<DIV></DIV>
<DIV>-Mike</DIV>
<DIV></DIV>
<DIV>-</DIV>
<DIV>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html</DIV></FONT></DIV></BODY></HTML>