Hi,

I have Ubuntu Server installed and I have a Windows 2008 Server Certificate Authority

When I type the openssl command I keep on getting this error:  CA certificate and CA private key do not match

  Any help or suggestions would be appreciated.

Thanks

Scott

Ps.  I was able to get Samba to work after loading the lates server Ubuntu 11.10.  Thanks for everyones help.

root@FreeRadius:/etc/freeradius/certs# openssl ca -policy policy_anything -out certificate.pem -passin pass:enterasys -key enterasys -extensions xpserver_ext -extfile xpextensions -infiles server.csr

Using configuration from /usr/lib/ssl/openssl.cnf

CA certificate and CA private key do not match

3074058392:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:318:

root@FreeRadius:/etc/freeradius/certs#

root@FreeRadius:/etc/freeradius/certs# openssl req -new -nodes -keyout mykey.pem -out server.csrGenerating a 1024 bit RSA private key

.......++++++

........++++++

writing new private key to 'mykey.pem'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:US

State or Province Name (full name) [Some-State]:MA

Locality Name (eg, city) []:Andover

Organization Name (eg, company) [Internet Widgits Pty Ltd]:Enterasys.com

Organizational Unit Name (eg, section) []:SQA

Common Name (eg, YOUR name) []:Scott

Email Address []:SQA@enterasys.com

Please enter the following 'extra' attributes

to be sent with your certificate request

enterasys []:enterasys

An optional company name []:Enterasys

root@FreeRadius:/etc/freeradius/certs#

root@FreeRadius:/etc/freeradius/certs# openssl pkcs12 -in "SQA 2008 System Certificate.p12" -out ca.pem

Enter Import Password:

MAC verified OK

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

root@FreeRadius:/etc/freeradius/certs# openssl ca -policy policy_anything -out certificate.pem -passin pass:enterasys -key enterasys -extensions xpserver_ext -extfile xpextensions -infiles server.csr

Using configuration from /usr/lib/ssl/openssl.cnf

CA certificate and CA private key do not match

3074058392:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:318:

root@FreeRadius:/etc/freeradius/certs#

OpenSSL.cnf file:

# OpenSSL example configuration file.

# This is mostly being used for generation of certificate requests.

#

# This definition stops the following lines choking if HOME isn't

# defined.

HOME                 = .

RANDFILE             = $ENV::HOME/.rnd

# Extra OBJECT IDENTIFIER info:

#oid_file            = $ENV::HOME/.oid

oid_section          = new_oids

# To use this configuration file with the "-extfile" option of the

# "openssl x509" utility, name here the section containing the

# X.509v3 extensions to use:

# extensions         =

# (Alternatively, use a configuration file that has only

# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.

# Add a simple OID like this:

# testoid1=1.2.3.4

# Or use config file substitution like this:

# testoid2=${testoid1}.5.6

# Policies used by the TSA examples.

tsa_policy1 = 1.2.3.4.1

tsa_policy2 = 1.2.3.4.5.6

tsa_policy3 = 1.2.3.4.5.7

####################################################################

[ ca ]

default_ca    = CA_default         # The default ca section

####################################################################

[ CA_default ]

dir           = /etc/freeradius           # Where everything is kept

certs         = $dir/certs         # Where the issued certs are kept

crl_dir       = $dir/crl           # Where the issued crl are keptcd ..

database      = $dir/index.txt     # database index file.

#unique_subject      = no                 # Set to 'no' to allow creation of

                                   # several ctificates with same subject.

new_certs_dir = $dir/certs         # default place for new certs.

certificate   = $certs/ca.pem      # The CA certificate

serial        = $dir/serial               # The current serial number

crlnumber     = $dir/crlnumber     # the current crl number

                                   # must be commented out to leave a V1 CRL

crl           = $dir/crl.pem              # The current CRL

private_key   = $certs/mykey.pem          # The private key

RANDFILE      = $certs/random      # private random number file

x509_extensions      = usr_cert           # The extentions to add to the cert

Directions I am Using:

The second way of doing this, which is not very neat, is as follows:

>From the computer where your freeradius is, you generate a request and a private key by:

   shell:~ # openssl req -new -nodes -keyout mykey.pem -out server.csr

The challenge password is important because it'll be used in the freeradius configuration

The file mykey.pem is the private key. Copy this file to /usr/local/etc/raddb/certs

   shell:~ # cp mykey.pem /usr/local/etc/raddb/certs

Then, from the computer where your CA authority is, open a Command prompt window and type:

   C:\>certutil -backup directory

It will prompt you for the password for your private key and will generate a backup of your CA private and public key inside the directory "directory". Let's say that your password is "password".

Then, go to "directory"

   C:\>cd directory

And copy the file "Certification Authority.p12" to the computer where your FreeRadius is. This file contains both your CA's private and public keys. Then, from your freeradius computer, you need to convert this file to a format more "manageable".

   shell:~ # openssl pkcs12 -in "Certification Authority.p12" -out ca.pem

Then, you need to modify your /etc/ssl/openssl.cnf file. Locate the section [ CA_default ] and modify the lines certificate and private_key, so they point to the file you generated in the last step. Those lines should look like:

certificate    = /root/ca.pem

private_key    = /root/ca.pem

Once you have finished doing these changes, then create a file called xpextensions with the following contents:

[ xpserver_ext ]

extendedKeyUsage = 1.3.6.1.5.5.7.3.1

This is required to add the extension needed for your certificate. Then

   shell:~ # openssl ca -policy policy_anything -out certificate.pem -passin pass:password -key password -extensions xpserver_ext -extfile xpextensions -infiles server.csr

Delete the file server.csr

   shell:~ # rm server.csr

And copy the files ca.pem and certificate.pem to /usr/local/etc/raddb/certs

   shell:~ # cp ca.pem certificate.pem /usr/local/etc/raddb/certs

It is preferable to delete all info about the private key from the file ca.pem, but it is up to you.

Now edit your eap.conf file and you are done. A sample eap.conf is at the end of this guide.

Configure your clients to use PEAP, check the checkbox "Validate server certificate" and select your Trusted Root Certification Authority from the list.

SAMPLE EAP.CONF

eap {

                default_eap_type = peap

                timer_expire     = 60

                ignore_unknown_eap_types = no

                cisco_accounting_username_bug = no

                tls {

                        private_key_password = #The challenge password you have chosen when you generated your private key

                        private_key_file = ${raddbdir}/certs/mykey.pem

                        certificate_file = ${raddbdir}/certs/certificate.pem

                        CA_file = ${raddbdir}/certs/ca.pem

                        dh_file = ${raddbdir}/certs/dh

                        random_file = /dev/urandom

                        fragment_size = 1024

                        include_length = yes

                }

                peap {

                        default_eap_type = mschapv2

                }

                mschapv2 {

                }

        }