- Freeradius-Users

24 Mar 2022

      Hello all,

Thank you all for your hard work in keeping FreeRadius excellent. I am
currently running FreeRADIUS 3.0.20. I am looking to solve an issue with
using a certificate purchased from GlobalSign with Android 11 clients. When
connecting to WiFi, we select EAP-PEAP and MSCHAPv2, then as the domain we
put the CA of the certificate we purchased, but when connecting, we get the
"ERROR: TLS Alert read:fatal:unknown CA". I have seen some information on
this error in previous threads (Alan DeKok said in a previous thread that
"That's an alert from the client. It doesn't recognize the CA which signed
the server certificate."). However, according to the list of official CA's
found here:
https://android.googlesource.com/platform/system/ca-certificates/+/master/fi...,
the GlobalSign Root CA is part of Android (filename b0f3e76e.0). I was able
to get this working fine with a Let's Encrypt Certificate (using cert.pem
as the certificate_file in mods-enabled/eap and fullchain.pem as the
ca_file in mods-enabled/eap). However, this isn't working with the
GlobalSign cert.pem and fullchain.pem (which I created manually with the
certificate and CA chain). Does anybody have any insights? When making the
fullchain.pem (shown below), I did it in this order: server, intermediate,
then root, like the Let's Encrypt fullchain.pem was, to no avail. The
reason we are using a GlobalSign certificate instead of the Let's Encrypt
certificate is so iOS users don't have to re-accept a new certificate every
90 days, only once per year. The reason for needing a cert from a signed CA
is so Android users don't have to import a CA to get on our 802.1x network.
My insights on the certificate chain have come from this article:
https://extremeportal.force.com/ExtrArticleDetail?an=000092023

Relevant output of freeradius -X

(4) eap: Expiring EAP session with state 0x070e85d2040b9ce9
(4) eap: Finished EAP session with state 0x070e85d2040b9ce9
(4) eap: Previous EAP request found for state 0x070e85d2040b9ce9, released
from the list
(4) eap: Peer sent packet with method EAP PEAP (25)
(4) eap: Calling submodule eap_peap to process data
(4) eap_peap: Continuing EAP-TLS
(4) eap_peap: Peer indicated complete TLS record size will be 7 bytes
(4) eap_peap: Got complete TLS record (7 bytes)
(4) eap_peap: [eaptls verify] = length included
(4) eap_peap: <<< recv TLS 1.2  [length 0002]
(4) eap_peap: ERROR: TLS Alert read:fatal:unknown CA
(4) eap_peap: TLS_accept: Need to read more data: error
(4) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL
routines:ssl3_read_bytes:tlsv1 alert unknown ca
(4) eap_peap: TLS - In Handshake Phase
(4) eap_peap: TLS - Application data.
(4) eap_peap: ERROR: TLS failed during operation
(4) eap_peap: ERROR: [eaptls process] = fail
(4) eap: ERROR: Failed continuing EAP PEAP (25) session.  EAP sub-module
failed
(4) eap: Sending EAP Failure (code 4) ID 5 length 4
(4) eap: Failed in EAP select

My cert.pem:

My fullchain.pem:

Thank you for your assistance. Apologies if this is a stupid question, I
have tried to solve this on my own but am currently at a roadblock*.*

Ben Dronen