On 15/02/2017 10:13, Marco Scholl wrote:
Then i have installed our root ca as trusted for all type (eap, smime, webserver ....). When i now connect by wlan or cable to the freeradius, i got an server certificate error. But when i open the dialog for confirmation, i see our root ca als trusted, i see the intermediate as trustend and i see the radius certificate as trust! ... when i use an normal webserver certificate from a public ca the problem not exists, after i confirm the certificate on first try. A couple of approaches:
(1) Try authenticating with eapol_test. This will give you a good debug log and it may be clearer what's wrong (e.g. you're not returning the intermediate CA as part of the response). Compare the response with the public CA webserver certificate and with your own certificate. It might be that the chain can be validated in one case, but not the other. (2) Compare the structure of the certificates themselves: openssl x509 -in filename.pem -noout -text And of course check the usual things: you are using the right private key which corresponds to the public key in the cert; the cert has not expired; the intermediate CA is valid and signed by the right root etc. The other thing you can do for MacOS is to create a profile. Get the "Apple Configurator Utility 2" from the App store; use it to create a .mobileconfig file which includes the root certificate and the wifi settings. This allows you also to bind the expected certificate identity ("Trusted Server Certificate Names"), i.e. the commonName that you put in your RADIUS sever cert. If the end-user then installs this profile, they'll be able to connect without any prompts. Regards, Brian.