Thanks. we're running on Ubuntu 16.04.5 LTS. Sorry about the very verbose debug output. I took it with raddebug and didn't know that's very verbose by default. Will take it to heart next time... Unfortunately freeradius -Xv doesn't show the linked OpenSSL server on our system: root@its-edurad-qm:~# freeradius -Xv radiusd: FreeRADIUS Version 3.0.17, for host x86_64-pc-linux-gnu FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT It really seems to go into that direction - I found the following article: https://support.microsoft.com/en-us/help/3121002/windows-10-devices-can-t-co... Thanks- Thorsten From: arr2036 [via FreeRADIUS] <ml+s1045715n5752781h6@n5.nabble.com> Sent: Thursday, 29 November 2018 02:27 To: Thorsten Fritsch <thorsten.fritsch@unibas.ch> Subject: Re: FreeRadius 3.0.17 - TLS issue
On Nov 28, 2018, at 6:48 AM, Alan DeKok <[hidden email]</user/SendEmail.jtp?type=node&node=5752781&i=0>> wrote:
On Nov 27, 2018, at 12:37 PM, Thorsten Fritsch <[hidden email]</user/SendEmail.jtp?type=node&node=5752781&i=1>> wrote:
we're running FR 3.0.17 and currently have some trouble with Windows 10 Clients which since just recently no longer can connect to the PEAP/MS-CHAPv2-based eduroam network.
According to the radius debug log the FR server sends an Access Accept to the NAS (Cisco WLC) but it then terminates with the information: ERROR: eap_peap: TLS Alert write:fatal:protocol version
Likely due to TLS 1.2.
53282519) Tue Nov 27 16:07:35 2018: Debug: Sent Access-Accept Id 251 from 131.152.21.100:1812 to 10.33.6.2:54247 length 0 (53282519) Tue Nov 27 16:07:35 2018: Debug: Tunnel-Type = VLAN
Don't sent "radiusd -Xx" please... all of the documentation says to just use "radiusd -X".
It looks like a TLS mismtach but not sure. Any experiences with this ? Which TLS versions are supported by FR 3.0.17 ?
FreeRADIUS uses OpenSSL for TLS. So check your OpenSSL library.
Odds are that you're running a version / OS which is a few years old, and doesn't support TLS 1.2. You'll have to upgrade to a recent release of OpenSSL in order to fix that.
radiusd -Xv should show you the version of OpenSSL the server is linked against. -Arran - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ If you reply to this email, your message will be added to the discussion below: http://freeradius.1045715.n5.nabble.com/FreeRadius-3-0-17-TLS-issue-tp575276... To unsubscribe from Users, click here<http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=2740693&code=dGhvcnN0ZW4uZnJpdHNjaEB1bmliYXMuY2h8Mjc0MDY5M3w1ODEyOTcyNzM=>. NAML<http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>