If fear not...

 eap {
                                         invalid = 1
                                                 }
                        if (invalid) {
                         update reply {
                        Tmp-String-5="INVALID Certificate"
                                }
...
 TLS_accept:error in SSLv3 read client certificate B
rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
SSL: SSL_read failed in a system call (-1), TLS session fails.
TLS receive handshake failed during operation
[tls] eaptls_process returned 4
[eap] Handler failed in EAP/tls
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
} # server cisco
Using Post-Auth-Type Reject
+- entering group REJECT {...}

...

Alan DeKok schrieb: 
Norbert Wegener wrote:
  
It seems, "if (invalid) " is not entered and I don't see why.
    

  The default behavior for "invalid" is to stop processing the request.
 This can be changed by:

        eap {
                invalid = 1
        }
        if ( invalid ) {
                ...

  I'm not sure the default behavior is really documented anywhere,
unfortunately.

  Alan DeKok.

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html