15 Jul
2020
15 Jul
'20
6:53 a.m.
On 15.07.20 12:33, Martin Pauly wrote:
I'm getting an obscure effect with FR 3.0.21 on a fresh Debian Buster installation (I compiled myself from the download package). Despite an identical config (as compared to the predecessor with FR 3.017 on Debian Jessie), some clients will not match the server cert to the chain provided. Seemingly, these are all Apple supplicants and also eapol_test, see attached output Any idea what's going wrong?
Is "auto_chain" on in your eap module? I found that quite often OpenSSL is not able to build the correct chain itself and I just switch it off completely via "auto_chain = no" and provide the complete (minus root-cert) chain myself via "certificate_file". Grüße, Sven.