Fair enough! :-) If you read the following instructions, where do you think the changes will need to be made if eap.conf file is nowhere to be found? Edit /etc/freeradius/eap.conf with the following changes 1. Change *default_eap_type* to “tls” 2. Comment out all the authentication methods sections except for tls 3. Comment out “private_key_password” with # 4. Change *private_key_file* to ${certdir}/radius.key 5. Change *certificate_file* to ${certdir}/radius.crt 6. Change *CA_file* to ${cadir}/ca.crt Below is a configuration file after the changes have made. [image: 69f8f9b8-9b8e-450c-8b95-3a15d4c67c6a] Thank you, Gleb On Thu, Apr 23, 2020 at 4:53 PM Alan DeKok <aland@deployingradius.com> wrote:
On Apr 23, 2020, at 4:04 PM, Gleb Lisikh <in4bit.general@gmail.com> wrote:
For the end system OS, I have no idea... Meraki web-based dashboard has
a built-in test tool to validate RADIUS configuration. This is what I used to check my setup so far, and haven't tried any "real" client
Ah.... then it's rather more difficult to fix.
Is there any way to see from the RADIUS server side what client is doing/sending wrong/incorrectly?
That error message from OpenSSL is all we have/
Meraki does have a set of instructions on how to configure freeRADIUS to work with Meraki EAP-TLS authentication, but those seem to be dated as I could not even find ./etc/freeradius/eap.conf file that they suggest to edit.
https://documentation.meraki.com/MR/Encryption_and_Authentication/Freeradius...
Perhaps you can help me to translate those instructions into 3.022 version terms and files to edit?
Well... no. I don't rewrite documentation for vendors.
We have documentation on how to configure EAP-TLS. See mods-available/eap. It's relatively straightforward.
And lastly, is there anything that had to be done in principle to enable EAP-TLS on the server irrespective of the client behaviour?
If the error is in OpenSSL, then you have to figure out *what* to configure.
The server works by default. There is no magical setting which turns off a *broken* configuration and enables a *working* one.
Alan DeKok.