Re: Rejecting EAP-TLS based on cert Subject field

Matt Garretson wrote:

Thanks. That's actually my goal. But unlang isn't allowed in authenticate{},

Yes, it is. You just need to put it into a subsection. See the comments around "eap" in the authenticate section for 2.1.10.

and my attempts to sneak it into the authentication phase via the tls{} section in eap.conf didn't seem to work.

Hmm... the "tls" section is a configuration section, and has nothing to do with the modules listed in the "authenticate" section. Alan DeKok.