Hi, I'm having an issue with FreeRADIUS 3.2.3 and the EAP module. It doesn't take into account my private PKI. I have to set the reject_unknown_intermediate_ca parameter to no for EAP-TLS authentication to work. I have no issues with FreeRADIUS 3.0.x My server is running RHEL 8 and my OpenSSL version is 1.1.1K Thanks for your help, Regards, --
mods-enabled/eap
eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} md5 { } gtc { auth_type = PAP } tls-config tls-common { private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = ${cadir}/chain.pem ca_path = ${cadir} reject_unknown_intermediate_ca = no cipher_list = "DEFAULT" cipher_server_preference = no tls_min_version = "1.2" tls_max_version = "1.2" ecdh_curve = "" cache { enable = no store { Tunnel-Private-Group-Id } } verify { } ocsp { enable = yes override_cert_url = no url = "http://127.0.0.1/ocsp/" } } tls { tls = tls-common } ttls { tls = tls-common default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } }
ls -l certs
total 32 lrwxrwxrwx. 1 root root 17 Jan 23 12:17 3377b39c.0 -> subca.pem lrwxrwxrwx. 1 root root 18 Jan 23 12:17 72f73b82.0 -> rootca.pem -rw-r-----. 1 root radiusd 4111 Jan 23 10:16 chain.pem -rw-r-----. 1 root radiusd 1818 Jan 23 10:17 rootca.pem -rw-r-----. 1 root radiusd 2293 Jan 23 10:17 subca.pem -rw-r-----. 1 root radiusd 1704 Jan 23 10:18 server.key -rw-r-----. 1 root radiusd 8567 Jan 23 10:18 server.pem
debug (if reject_unknown_intermediate_ca = yes)
[...] Certificate chain - 1 cert(s) untrusted (TLS) untrusted certificate with depth [1] subject name /CN=SubCA (TLS) untrusted certificate with depth [0] subject name /CN=device tls: There are untrusted certificates in the certificate chain. Rejecting. (10) eap_tls: (TLS) send TLS 1.2 Alert, fatal internal_error (10) eap_tls: ERROR: (TLS) Alert write:fatal:internal error (10) eap_tls: ERROR: (TLS) Server : Error in error (10) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed (10) eap_tls: ERROR: (TLS) System call (I/O) error (-1) (10) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation (10) eap_tls: ERROR: [eaptls process] = fail (10) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (10) eap: Sending EAP Failure (code 4) ID 26 length 4 (10) eap: Failed in EAP select (10) [eap] = invalid (10) } # authenticate = invalid (10) Failed to authenticate the user (10) Using Post-Auth-Type Reject [...]