Freeradius with Docker - got Unknown CA error

8 Aug 2019

      Hi,

I have a working radiusd.conf which can do EAP-TLS authentication. I am
able to run the FreeRadius server in Ubuntu directly. Now I am trying to
make the FreeRadius server running in Docker and upload it to GCP. However,
with the same radiusd.conf, I got the error "TLS Alert read:fatal:unknow
CA".

In my radiusd.conf, I have something like:
modules {
        eap {
                ...
                tls {
                        certdir = certs
                        private_key_file = ${certdir}/server.key
                        certificate_file = ${certdir}/server.pem
                        ca_file = ${certdir}/ca.pem
                        cipher_list = "HIGH"
                        ecdh_curve = "prime256v1"
                }
        }
}

In my Dockerfile, I first have something like:
WORKDIR /radius
COPY radiusd.conf /radius
COPY certs/ /radius/certs

So the working directory has radiusd.conf and certs/ directory containing
all the certificates.
With eapol_test given the same ca.pem as input, I got the below errors from
FreeRadius output. I got the same errors even if I change the Docker file
to the absolute path of FreeRadius:
COPY radiusd.conf /etc/freeradius/3.0/
COPY certs/ /etc/freeradius/3.0/certs/

Output:

(0) Received Access-Request Id 0 from 104.132.1.66:42257 to 172.17.0.3:1812
length 134
(0)   User-Name = "myusername"
(0)   NAS-IP-Address = 127.0.0.1
(0)   Calling-Station-Id = "02-00-00-00-00-01"
(0)   Framed-MTU = 1400
(0)   NAS-Port-Type = Wireless-802.11
(0)   Service-Type = Framed-User
(0)   Connect-Info = "CONNECT 11Mbps 802.11b"
(0)   EAP-Message = 0x02ea000f016d79757365726e616d65
(0)   Message-Authenticator = 0x064274c68e846bd643f10ee42c9a9f58
(0) # Executing section authorize from file ./radiusd.conf
(0)   authorize {
(0) eap: Peer sent EAP Response (code 2) ID 234 length 15
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file ./radiusd.conf
(0)   authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_tls to process data
(0) eap_tls: Initiating new TLS session
(0) eap_tls: Setting verify mode to require certificate from client
(0) eap_tls: [eaptls start] = request
(0) eap: Sending EAP Request (code 1) ID 235 length 6
(0) eap: EAP session adding &reply:State = 0x3c1cb3283cf7be5d
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) Post-Auth-Type sub-section not found.  Ignoring.
(0) Sent Access-Challenge Id 0 from 172.17.0.3:1812 to 104.132.1.66:42257
length 0
(0)   EAP-Message = 0x01eb00060d20
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0x3c1cb3283cf7be5deafe5da3e677933c
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 1 from 104.132.1.66:42257 to 172.17.0.3:1812
length 333
(1)   User-Name = "myusername"
(1)   NAS-IP-Address = 127.0.0.1
(1)   Calling-Station-Id = "02-00-00-00-00-01"
(1)   Framed-MTU = 1400
(1)   NAS-Port-Type = Wireless-802.11
(1)   Service-Type = Framed-User
(1)   Connect-Info = "CONNECT 11Mbps 802.11b"
(1)   EAP-Message =
0x02eb00c40d0016030100b9010000b50303651de82eea44d48516e3c1e705e1c3913aa0b4a3f6b029b7affcccdd7fd8d9f6000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000054000b000403000102000a000c000a001d0017001e001900180016000000170000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602
(1)   State = 0x3c1cb3283cf7be5deafe5da3e677933c
(1)   Message-Authenticator = 0x0016f403f73e4237308bb89e1eb39d88
(1) session-state: No cached attributes
(1) # Executing section authorize from file ./radiusd.conf
(1)   authorize {
(1) eap: Peer sent EAP Response (code 2) ID 235 length 196
(1) eap: No EAP Start, assuming it's an on-going EAP conversation
(1)     [eap] = updated
(1)   } # authorize = updated
(1) Found Auth-Type = eap
(1) # Executing group from file ./radiusd.conf
(1)   authenticate {
(1) eap: Expiring EAP session with state 0x3c1cb3283cf7be5d
(1) eap: Finished EAP session with state 0x3c1cb3283cf7be5d
(1) eap: Previous EAP request found for state 0x3c1cb3283cf7be5d, released
from the list
(1) eap: Peer sent packet with method EAP TLS (13)
(1) eap: Calling submodule eap_tls to process data
(1) eap_tls: Continuing EAP-TLS
(1) eap_tls: Got final TLS record fragment (190 bytes)
(1) eap_tls: WARNING: Total received TLS record fragments (190 bytes), does
not equal indicated TLS record length (0 bytes)
(1) eap_tls: [eaptls verify] = ok
(1) eap_tls: Done initial handshake
(1) eap_tls: (other): before SSL initialization
(1) eap_tls: TLS_accept: before SSL initialization
(1) eap_tls: TLS_accept: before SSL initialization
(1) eap_tls: <<< recv TLS 1.3  [length 00b9]
(1) eap_tls: TLS_accept: SSLv3/TLS read client hello
(1) eap_tls: >>> send TLS 1.2  [length 0035]
(1) eap_tls: TLS_accept: SSLv3/TLS write server hello
(1) eap_tls: >>> send TLS 1.2  [length 0707]
(1) eap_tls: TLS_accept: SSLv3/TLS write certificate
(1) eap_tls: >>> send TLS 1.2  [length 00af]
(1) eap_tls: TLS_accept: SSLv3/TLS write certificate request
(1) eap_tls: >>> send TLS 1.2  [length 0004]
(1) eap_tls: TLS_accept: SSLv3/TLS write server done
(1) eap_tls: TLS_accept: Need to read more data: SSLv3/TLS write server done
(1) eap_tls: TLS - In Handshake Phase
(1) eap_tls: TLS - got 2051 bytes of data
(1) eap_tls: [eaptls process] = handled
(1) eap: Sending EAP Request (code 1) ID 236 length 1024
(1) eap: EAP session adding &reply:State = 0x3c1cb3283df0be5d
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) Post-Auth-Type sub-section not found.  Ignoring.
(1) Sent Access-Challenge Id 1 from 172.17.0.3:1812 to 104.132.1.66:42257
length 0
(1)   EAP-Message =
0x01ec04000dc0000008031603030035020000310303cce50e6fc3074f99584c4bbd99b4b26f5eddf075568fd37fd1954ad7a144c66f00009d000009ff010001000017000016030307070b00070300070000033e3082033a30820222020107300d06092a864886f70d01010b05003071310b30090603550406130255533116301406035504080c0d4d617373616368757365747473310f300d06035504070c06426f73746f6e31133011060355040a0c0a427574746f6e776f6f643124302206035504030c1b427574746f6e776f6f642054657374204341204465632032303138301e170d3138313231393231303133365a170d3138313232393231303133365a3055310b30090603550406130255533116301406035504080c0d4d61737361636875736574747331163014060355040a0c0d526164697573205365727665723116301406035504030c0d5261646975732053657276657230820122300d06092a864886f70d01010105000382010f003082010a02820101
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0x3c1cb3283df0be5deafe5da3e677933c
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 2 from 104.132.1.66:42257 to 172.17.0.3:1812
length 143
(2)   User-Name = "myusername"
(2)   NAS-IP-Address = 127.0.0.1
(2)   Calling-Station-Id = "02-00-00-00-00-01"
(2)   Framed-MTU = 1400
(2)   NAS-Port-Type = Wireless-802.11
(2)   Service-Type = Framed-User
(2)   Connect-Info = "CONNECT 11Mbps 802.11b"
(2)   EAP-Message = 0x02ec00060d00
(2)   State = 0x3c1cb3283df0be5deafe5da3e677933c
(2)   Message-Authenticator = 0xfcf988c59d274c385b0cb87554a6fb82
(2) session-state: No cached attributes
(2) # Executing section authorize from file ./radiusd.conf
(2)   authorize {
(2) eap: Peer sent EAP Response (code 2) ID 236 length 6
(2) eap: No EAP Start, assuming it's an on-going EAP conversation
(2)     [eap] = updated
(2)   } # authorize = updated
(2) Found Auth-Type = eap
(2) # Executing group from file ./radiusd.conf
(2)   authenticate {
(2) eap: Expiring EAP session with state 0x3c1cb3283df0be5d
(2) eap: Finished EAP session with state 0x3c1cb3283df0be5d
(2) eap: Previous EAP request found for state 0x3c1cb3283df0be5d, released
from the list
(2) eap: Peer sent packet with method EAP TLS (13)
(2) eap: Calling submodule eap_tls to process data
(2) eap_tls: Continuing EAP-TLS
(2) eap_tls: Peer ACKed our handshake fragment
(2) eap_tls: [eaptls verify] = request
(2) eap_tls: [eaptls process] = handled
(2) eap: Sending EAP Request (code 1) ID 237 length 1024
(2) eap: EAP session adding &reply:State = 0x3c1cb3283ef1be5d
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) Post-Auth-Type sub-section not found.  Ignoring.
(2) Sent Access-Challenge Id 2 from 172.17.0.3:1812 to 104.132.1.66:42257
length 0
(2)   EAP-Message =
0x01ed04000dc00000080374746f6e776f6f643124302206035504030c1b427574746f6e776f6f642054657374204341204465632032303138301e170d3138313231393136353033385a170d3139303131383136353033385a3071310b30090603550406130255533116301406035504080c0d4d617373616368757365747473310f300d06035504070c06426f73746f6e31133011060355040a0c0a427574746f6e776f6f643124302206035504030c1b427574746f6e776f6f64205465737420434120446563203230313830820122300d06092a864886f70d01010105000382010f003082010a0282010100a510110045315159b7107ba22629b7a59c16da413ed72112277d4498e02a6f7456d63444de8038dd72cc2094cc0c29b735d05004292b0721dec7b6c781ef06c9703069077776c7984927763fb06a77d11cfeb7fe080edad8d52d471f9c9c125a4cd0a9a35d0d9ada21a3ccaf74a6fde206b7a9c7533cadd02669d58e5aed57e3993851b296199134b8f355
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0x3c1cb3283ef1be5deafe5da3e677933c
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 3 from 104.132.1.66:42257 to 172.17.0.3:1812
length 143
(3)   User-Name = "myusername"
(3)   NAS-IP-Address = 127.0.0.1
(3)   Calling-Station-Id = "02-00-00-00-00-01"
(3)   Framed-MTU = 1400
(3)   NAS-Port-Type = Wireless-802.11
(3)   Service-Type = Framed-User
(3)   Connect-Info = "CONNECT 11Mbps 802.11b"
(3)   EAP-Message = 0x02ed00060d00
(3)   State = 0x3c1cb3283ef1be5deafe5da3e677933c
(3)   Message-Authenticator = 0xcbc352d3a078978d17e6fa7616a196e4
(3) session-state: No cached attributes
(3) # Executing section authorize from file ./radiusd.conf
(3)   authorize {
(3) eap: Peer sent EAP Response (code 2) ID 237 length 6
(3) eap: No EAP Start, assuming it's an on-going EAP conversation
(3)     [eap] = updated
(3)   } # authorize = updated
(3) Found Auth-Type = eap
(3) # Executing group from file ./radiusd.conf
(3)   authenticate {
(3) eap: Expiring EAP session with state 0x3c1cb3283ef1be5d
(3) eap: Finished EAP session with state 0x3c1cb3283ef1be5d
(3) eap: Previous EAP request found for state 0x3c1cb3283ef1be5d, released
from the list
(3) eap: Peer sent packet with method EAP TLS (13)
(3) eap: Calling submodule eap_tls to process data
(3) eap_tls: Continuing EAP-TLS
(3) eap_tls: Peer ACKed our handshake fragment
(3) eap_tls: [eaptls verify] = request
(3) eap_tls: [eaptls process] = handled
(3) eap: Sending EAP Request (code 1) ID 238 length 33
(3) eap: EAP session adding &reply:State = 0x3c1cb3283ff2be5d
(3)     [eap] = handled
(3)   } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) Post-Auth-Type sub-section not found.  Ignoring.
(3) Sent Access-Challenge Id 3 from 172.17.0.3:1812 to 104.132.1.66:42257
length 0
(3)   EAP-Message =
0x01ee00210d8000000803737420434120446563203230313816030300040e000000
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   State = 0x3c1cb3283ff2be5deafe5da3e677933c
(3) Finished request
Waking up in 4.9 seconds.
(4) Received Access-Request Id 4 from 104.132.1.66:42257 to 172.17.0.3:1812
length 150
(4)   User-Name = "myusername"
(4)   NAS-IP-Address = 127.0.0.1
(4)   Calling-Station-Id = "02-00-00-00-00-01"
(4)   Framed-MTU = 1400
(4)   NAS-Port-Type = Wireless-802.11
(4)   Service-Type = Framed-User
(4)   Connect-Info = "CONNECT 11Mbps 802.11b"
(4)   EAP-Message = 0x02ee000d0d0015030300020230
(4)   State = 0x3c1cb3283ff2be5deafe5da3e677933c
(4)   Message-Authenticator = 0x6a8e3ca3d60a68499ed73d0b8dd61b82
(4) session-state: No cached attributes
(4) # Executing section authorize from file ./radiusd.conf
(4)   authorize {
(4) eap: Peer sent EAP Response (code 2) ID 238 length 13
(4) eap: No EAP Start, assuming it's an on-going EAP conversation
(4)     [eap] = updated
(4)   } # authorize = updated
(4) Found Auth-Type = eap
(4) # Executing group from file ./radiusd.conf
(4)   authenticate {
(4) eap: Expiring EAP session with state 0x3c1cb3283ff2be5d
(4) eap: Finished EAP session with state 0x3c1cb3283ff2be5d
(4) eap: Previous EAP request found for state 0x3c1cb3283ff2be5d, released
from the list
(4) eap: Peer sent packet with method EAP TLS (13)
(4) eap: Calling submodule eap_tls to process data
(4) eap_tls: Continuing EAP-TLS
(4) eap_tls: [eaptls verify] = ok
(4) eap_tls: Done initial handshake
(4) eap_tls: <<< recv TLS 1.2  [length 0002]
(4) eap_tls: ERROR: TLS Alert read:fatal:unknown CA
(4) eap_tls: TLS_accept: Need to read more data: error
(4) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL
routines:ssl3_read_bytes:tlsv1 alert unknown ca
(4) eap_tls: TLS - In Handshake Phase
(4) eap_tls: TLS - Application data.
(4) eap_tls: ERROR: TLS failed during operation
(4) eap_tls: ERROR: [eaptls process] = fail
(4) eap: ERROR: Failed continuing EAP TLS (13) session.  EAP sub-module
failed
(4) eap: Sending EAP Failure (code 4) ID 238 length 4
(4) eap: Failed in EAP select
(4)     [eap] = invalid
(4)   } # authenticate = invalid
(4) Failed to authenticate the user
(4) Using Post-Auth-Type Reject
(4) Post-Auth-Type sub-section not found.  Ignoring.
(4) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(4) Sending delayed response
(4) Sent Access-Reject Id 4 from 172.17.0.3:1812 to 104.132.1.66:42257
length 44
(4)   EAP-Message = 0x04ee0004
(4)   Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 0 with timestamp +61
(1) Cleaning up request packet ID 1 with timestamp +61
(2) Cleaning up request packet ID 2 with timestamp +61
(3) Cleaning up request packet ID 3 with timestamp +61
(4) Cleaning up request packet ID 4 with timestamp +61
Ready to process requests

Any ideas? Thanks in advance!

Best,
Holly

Freeradius with Docker - got Unknown CA error

Jiuyu Sun