Hi, I am using pkcs8 file format in private key file (eap config file) placeholder. private_key_file = ${certdir}/*DevFromRoot-Server-AABBCCDD.pkcs8* But after that when i restart freeradius i get the following error: *rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line* *rlm_eap_tls: Error reading private key file /etc/freeradius/certs/DevFromRoot-Server-AABBCCDD.pkcs8* *rlm_eap: Failed to initialize type tls* */etc/freeradius/eap.conf[17]: Instantiation failed for module "eap"* */etc/freeradius/sites-enabled/default[310]: Failed to load module "eap".* If i use the .pem file format it works! Regards Sumant
I am using pkcs8 file format in private key file (eap config file) placeholder.
Doubtful. You can use OpenSSL to convert between PKCS8 and PEM: http://help.globalscape.com/help/secureserver3/Converting_a_PEM_Encoded_PKCS... Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp@jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
is there any particular reason why you are using a pkcs8 file format ? (just wondering if this is becoming a 'thing' - if so whether a feature request to support it)? alan
Actually I am using a certificates generator tool which gives the output in pkcs8 format. So they need to be imported in radius . Seems like radius is not supporting the format. It would be good if radius supports the format as the task of converting into pem format will be eliminated. -sumant On Tuesday, November 28, 2017, Alan Buxey <alan.buxey@gmail.com> wrote:
is there any particular reason why you are using a pkcs8 file format ? (just wondering if this is becoming a 'thing' - if so whether a feature request to support it)?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Nov 28, 2017, at 12:00 PM, Sumant Gupta <sumantgupta@gmail.com> wrote:
Actually I am using a certificates generator tool which gives the output in pkcs8 format. So they need to be imported in radius . Seems like radius is not supporting the format.
No. FreeRADIUS doesn't implement all of SSL / TLS. We rely on OpenSSL to do that. As a result, FreeRADIUS requires the use of certificate formats that keep OpenSSL happy. Because OpenSSL reads those certs. FreeRADIUS doesn't.
It would be good if radius supports the format as the task of converting into pem format will be eliminated.
It would be good to understand what's going on before making passive-aggressive suggestions. Alan DeKok.
participants (4)
-
Alan Buxey -
Alan DeKok -
Stefan Paetow -
Sumant Gupta