Hi all, I'm trying to configure Freeradius (version 3.2.3 on Ubuntu 22.04) to perform either EAP-TLS and EAP-PEAP MSCHAPv2. I need MSCHAPv2 as alternative configuration for Android 11 devices because we are experiencing the deletion of client certificates and I'm not understand why this issue happens. The EAP-TLS configuration works fine with self signed CA and client certs signed by our private CA (except for Android 11 devices as I said). Below are the logs when I try to connect to Freeradius using MSCHAPv2 (I enabled "bob" user): (6) Received Access-Request Id 194 from 172.31.190.2:32773 to 172.31.189.84:1812 length 291 (6) User-Name = "bob" (6) Chargeable-User-Identity = 0x00 (6) Location-Capable = Civic-Location (6) Calling-Station-Id = "9a-8b-7b-d9-b0-cd" (6) Called-Station-Id = "04-5f-b9-81-69-80:PIT_Tag" (6) NAS-Port = 1 (6) Cisco-AVPair = "audit-session-id=ac1fc7020000006765980031" (6) Acct-Session-Id = "65980031/9a:8b:7b:d9:b0:cd/108" (6) NAS-IP-Address = 172.31.190.2 (6) NAS-Identifier = "Cisco_b8:24:65" (6) Airespace-Wlan-Id = 2 (6) Service-Type = Framed-User (6) Framed-MTU = 1300 (6) NAS-Port-Type = Wireless-802.11 (6) Tunnel-Type:0 = VLAN (6) Tunnel-Medium-Type:0 = IEEE-802 (6) Tunnel-Private-Group-Id:0 = "190" (6) EAP-Message = 0x0207001119800000000715030300020230 (6) State = 0xc9ea21cfcced38f11a447042a250057a (6) Message-Authenticator = 0xc33e5f6f8276b61b9ab132b4687b2bdb (6) Restoring &session-state (6) &session-state:Framed-MTU = 994 (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (6) # Executing section authorize from file /etc/freeradius/sites-enabled/tlcamb-tag (6) authorize { (6) [preprocess] = ok (6) eap: Peer sent EAP Response (code 2) ID 7 length 17 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/sites-enabled/tlcamb-tag (6) authenticate { (6) eap: Expiring EAP session with state 0xc9ea21cfcced38f1 (6) eap: Finished EAP session with state 0xc9ea21cfcced38f1 (6) eap: Previous EAP request found for state 0xc9ea21cfcced38f1, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: (TLS) EAP Peer says that the final record size will be 7 bytes (6) eap_peap: (TLS) EAP Got all data (7 bytes) (6) eap_peap: (TLS) recv TLS 1.2 Alert, fatal unknown_ca (6) eap_peap: (TLS) The client is informing us that it does not recognize the CA used to issue the server certificate. Please update the client so that it knows about the CA. (6) eap_peap: ERROR: (TLS) Alert read:fatal:unknown CA tls: Removing session f3cdb8967121c0da520898ab8e5f39f803d24f44133c7ba63a4cbfb0ea161412 from the cache tls: Could not remove persisted session file /var/log/freeradius/tlscache/f3cdb8967121c0da520898ab8e5f39f803d24f44133c7ba63a4cbfb0ea161412.asn1: Permission denied (6) eap_peap: (TLS) Server : Need to read more data: error (6) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:0A000418:SSL routines::tlsv1 alert unknown ca (6) eap_peap: (TLS) In Handshake Phase (6) eap_peap: (TLS) Application data. (6) eap_peap: ERROR: (TLS) Cannot continue, as the peer is misbehaving. (6) eap_peap: ERROR: [eaptls process] = fail (6) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (6) eap: Sending EAP Failure (code 4) ID 7 length 4 (6) eap: Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/freeradius/sites-enabled/tlcamb-tag (6) Post-Auth-Type REJECT { (6) attr_filter.access_reject: EXPAND %{User-Name} (6) attr_filter.access_reject: --> bob (6) attr_filter.access_reject: Matched entry DEFAULT at line 11 (6) [attr_filter.access_reject] = updated (6) } # Post-Auth-Type REJECT = updated (6) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (6) Sending delayed response (6) Sent Access-Reject Id 194 from 172.31.189.84:1812 to 172.31.190.2:32773 length 44 (6) EAP-Message = 0x04070004 (6) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 188 with timestamp +10 due to cleanup_delay was reached (1) Cleaning up request packet ID 189 with timestamp +10 due to cleanup_delay was reached (2) Cleaning up request packet ID 190 with timestamp +10 due to cleanup_delay was reached (3) Cleaning up request packet ID 191 with timestamp +10 due to cleanup_delay was reached (4) Cleaning up request packet ID 192 with timestamp +10 due to cleanup_delay was reached (5) Cleaning up request packet ID 193 with timestamp +10 due to cleanup_delay was reached (6) Cleaning up request packet ID 194 with timestamp +10 due to cleanup_delay was reached Ready to process requests Thanks and best regards. Dario Barbon