I think I figured it out. There is a behavior change in freeradius. In 3.0.26, the partial_chain flag is only set if the server is using a certificate chain file. if ca_path or ca_file is configured, the partial_chain flag is not set (the cert_store is reinit based on ca_path or ca_file) But in 3.2.x, the partial_chain flag is always set to cert_store. But this not only affects the verify_cert_store, but also the chain_cert_store. Ideally we should only set partial_chain flag to verify_cert_store, so that we can do partial chain verification when verifying a client cert. But still try our best to build the full server cert chain based on chain_cert_store. -dave On Tue, Jun 30, 2026 at 6:16 AM Alan DeKok via Freeradius-Users < freeradius-users@lists.freeradius.org> wrote:
On Jun 29, 2026, at 7:56 PM, Dave Wang <dave.ftnt@gmail.com> wrote:
Recently I upgraded from freeradius 3.0.26 (with openssl 3.0.20) to 3.2.7/3.2.8,
Why not use 3.2.10?
(with openssl 3.5.0), and I noticed that the server does not send the full certificate chain to the EAP client anymore.
The server certificate has a chained structure like cert->intermediate CA2->intermediate CA1->root CA, and I am relying on the auto_chain and the ca_path to construct the chain on the freeradius side.
Now it only sends the server_certificate + intermediate CA2, but previously it sent all *four* certificates. Is this a known issue?
No, but it might be related to differing OpenSSL behavior.
Disable auto_chain, and create the chains manually. As the comments for auto_chain say, sometimes OpenSSL gets it wrong.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html