The "surgery" performed was simply to remove the repeating lines and define the two separate errors. Certs are in files, user has permission to read them (buried it in the users own profile directory to secure them better) I have the XpExtentsions and its referenced in the cert creation batchfile I have.
-----Original Message----- From: freeradius-users-bounces+nova5radius=gmail.com@lists.freeradius.org [mailto:freeradius-users- bounces+nova5radius=gmail.com@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Sunday, October 08, 2006 3:33 PM To: FreeRadius users mailing list Subject: Re: EAP-TLS Certificate problems.
Brian vb wrote:
the radius systems log. I have created 3 certificates, Root, Client, Server. The Root and Client certificates were installed via the MMC snapin and Import wizard in XP. Any idea on what could be causing the errors? If I
On the server, the certificates are in *files* yes?
tls: private_key_file = "C:/Docume~1/radius/rcerts/cert-srv.pem" tls: certificate_file = "C:/Docume~1/radius/rcerts/cert-srv.pem" tls: CA_file = "C:/Docume~1/radius/rcerts/root.pem" tls: private_key_password = "SuperSecretCode"
They're there and valid?
Sending Access-Challenge of id 50 to 10.1.1.189 port 1039 EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd2f07585b4ad88459f3f0f28a7fa6fb2 Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 48 with timestamp 45283c27 Cleaning up request 1 ID 49 with timestamp 45283c27 Cleaning up request 2 ID 50 with timestamp 45283c27 Nothing to do. Sleeping until we see a request.
This looks like the server certificate doesn't have the magic oids - the XP client stops halfway through. Search the archives for "magic oids"
Error 1 is seen if I have Validate Server Certificate check on the XP Laptop.
--Error 1-- Sat Oct 7 19:35:58 2006 : Error: TLS_accept:error in SSLv3 read client certificate A ------
Error 2 is seen if Validate is unchecked on the laptop
--Error 2-- Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read
client
certificate A Sat Oct 7 19:34:35 2006 : Error: --> verify error:num=20:unable to get local issuer certificate Sat Oct 7 19:34:35 2006 : Error: TLS Alert write:fatal:unknown CA Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client certificate B Sat Oct 7 19:34:35 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Oct 7 19:34:35 2006 : Auth: Login incorrect: [shadowwolf/<no User-Password attribute>] (from client netnas port 11 cli 0014a5104864) -----
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Since you've obviously performed some kind of surgery on the debug logs here, it's difficult to determine precisely what the context for these two errors are. What is the single, full, unaltered debug output for the failure case you're actually trying to solve? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html