<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title></title>
<style type="text/css">
<!--
body{margin-left:10px;margin-right:10px;margin-top:10px;margin-bottom:10px;}
-->
</style>
</head>
<body marginleft="10" marginright="10" margintop="10" marginbottom="10">
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Good afternoon All,</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">I've taken some time over the last couple little while to work with my test environment in getting it upto date and trying out some issues with regards authenticating against multiple certificates on a single SSID for the purpose of migration to a new root certificate while still continuing to function with the old in the transition phase.</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">What I'm finding tho is that when I try to authenticate against that particular server, which now has both its own certs applied and the root cert from my production server as well to replicate the instance of a new root being installed, is that I can authenticate a user with the specific certs for the test server, but not a client using certs for the production server.</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">I've taken a few captures of the server coming online using -X, an attempted connection with the production certs and also the configuration of my eap.conf file. I can see in initial stages that the EAP-TLS actually reads a bit of what the client is passing, enough to say that it has a valid client cert. But when it comes back to dive deeper into the cert, it appears that it does not recognize the CA as being there and bottoms out the request with a reject.</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">I've got both roots in a single file in the directory specified and when I do an openssl verify on the roots, it does come back :ok. I found some articles on how to link up the new certificate in openssl so that it can at least read it properly as trusted. But the FR server appears not to recognize it on the second pass. Perhaps I'm missing something, but is it even possible to authenticate using both root CA's at one time?</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Thank you in advance for any assistance / guidance anyone can provide with this.</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Regards,</font></div>
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Mitch</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Mitch Yackobeck, MCSE, MCSA, MCP, CCNA, CompTia Network+</font></div>
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Network Systems Administrator</font></div>
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Renfrew County District School Board</font></div>
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">1270 Pembroke Street West</font></div>
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Pembroke, ON K8A 4G4</font></div>
<div align="left" style="text-align:left;"><font face="Arial" size="+1" color="#000000" style="font-family:Arial;font-size:14pt;color:#000000;">Phone: (613) 735-0151 Ext. 2278</font></div>
<br/>
</body>
</html>