On 4 Dec 2015, at 14:23, Dennis Xu <dxu@uoguelph.ca> wrote:
PEAP does not need to check certificate on client. It is not EAP-TLS. Is there an option to disable the client side certificate validation?
No we don't have PKI, so not the same CA as AD. It is just a third party trusted CA from Thawte.
You need to bundle as much of the certificate chain as required in the server certificate file, to allow the client to establish the trust relationship from one of its roots to your certificate. So you need your server cert, and the intermediary CAs all concatenated together in the same file. Easiest to do this with PEM, as you can just cat >> the base64 armoured certs together. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2