Freeradius-Users

Download

freeradius-users@lists.freeradius.org

August 2026

2 participants
2 discussions

FreeRADIUS 3.2.8 EAP-TLS OCSP fails with AWS Private CA: signer certificate not found
by andrew.aveyard＠justice.gov.uk 12 Aug '26

12 Aug '26

Hi all, We are investigating an OCSP validation issue with FreeRADIUS 3.2.8 and AWS ACM Private CA managed OCSP. EAP-TLS certificate validation works when native OCSP is disabled. When native OCSP is enabled, authentication fails during the OCSP check with: (11) eap_tls: Starting OCSP Request (11) eap_tls: ocsp: Using responder URL "http://ocsp.acm-pca.eu-west-2.amazonaws.com:80/" (11) eap_tls: ERROR: (TLS) ocsp: Couldn't verify OCSP basic response: error:13800076:OCSP routines::signer certificate not found (11) eap_tls: ERROR: (TLS) ocsp: Certificate has been expired/revoked (11) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:0A000086:SSL routines::certificate verify failed (11) Sent Access-Reject Environment: FreeRADIUS: 3.2.8 OS/container: Alpine 3.23 TLS: EAP-TLS via rlm_eap OCSP responder: AWS ACM Private CA managed OCSP OCSP nonce: disabled, as AWS Private CA managed OCSP does not support request extensions The relevant section from EAP TLS configuration is: verify { tmpdir = /tmp/radiusd client = "/usr/bin/openssl verify -verbose -CAfile ${certdir}/ca-bundle.pem -CApath ${certdir} %{TLS-Client-Cert-Filename}" } ocsp { enable = yes override_cert_url = no use_nonce = no } } The OCSP response from AWS contains: OCSP Response Status: successful (0x0) Response Type: Basic OCSP Response Responder Id: C = GB, O = xxxxxx, OU = NACS, CN = xxxxxxxxxxxxxx-20260701113446 Cert Status: good This Update: Aug 11 10:18:25 2026 GMT Next Update: Aug 18 09:18:25 2026 GMT Signature Algorithm: sha256WithRSAEncryption We do not see an embedded responder certificate in the OCSP response output. The responder ID appears to match the issuing CA. Standalone OpenSSL tests inside the same container succeed. Command without -verify_other: openssl ocsp \ -issuer issuing-ca.pem \ -cert ocsp-test-client.pem \ -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \ -CAfile root-ca.pem \ -no_nonce \ -resp_text Result: Response verify OK ocsp-test-client.pem: good Command with -verify_other: openssl ocsp \ -issuer issuing-ca.pem \ -cert ocsp-test-client.pem \ -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \ -CAfile root-ca.pem \ -verify_other issuing-ca.pem \ -no_nonce \ -resp_text Result: Response verify OK ocsp-test-client.pem: good We have also tested EAP-TLS with the supplicant sending: 1. leaf certificate + issuing CA 2. leaf certificate only Both cases fail in FreeRADIUS native OCSP with the same error: OCSP routines::signer certificate not found We have also tested adding root + issuing CA to ca-bundle.pem, configuring both ca_file and ca_path, and running openssl rehash on the certificate directories before FreeRADIUS starts. That did not change the FreeRADIUS native OCSP result. So the current state is: - AWS OCSP endpoint is reachable from the container - AWS returns Cert Status: good - standalone OpenSSL ocsp verification succeeds inside the same container - FreeRADIUS native OCSP fails during EAP-TLS with signer certificate not found - the failure occurs even when the issuing CA is in ca_file/ca_path - the failure occurs whether the client sends leaf+issuer or leaf only I found this earlier mailing-list thread which looks similar: https://lists.freeradius.org/hyperkitty/list/freeradius-users@lists.freerad… In that thread, the discussion mentions responder certificate purpose / OCSPSigning. In our case the AWS response responder ID appears to be the issuing CA itself, and standalone OpenSSL verifies the response successfully. My question is: what additional certificate/context does FreeRADIUS 3.2.8 need for native OCSP verification here, given that the same OCSP response verifies successfully with standalone OpenSSL in the same container? Is there any additional debug output or specific certificate inspection that would help confirm why FreeRADIUS cannot locate the OCSP response signer? Thanks, Andrew

1 0

New mailman server
by Arran Cudbard-Bell 11 Aug '26

11 Aug '26

Hi All, The mailing lists (users, devel, announce), have been upgraded to Mailman 3.3. Accounts should've migrated across with preferences, and credentials preserved. Please report any issues. Many Thanks, -Arran

1 1