EAP-TLS with Client Cert, with Key Usage "EAP over Lan"
Hello, I have trouble to get 802.1x Authentication with EAP-TLS properly running. My Setup is the following: Server: FreeRADIUS Version 2.2.5, for host i586-pc-linux-gnu, built on Oct 24 2014 at 04:18:43 Switch: A NEXANS iSwitch G 1043E Client/Device: Yocto based Linux with wpa_supplicant v2.4 My Problem is the usage of the "X509v3 Extendend Key Usage" in the Certificate of the Client. If I use at the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, TLS Web Client Authentication" the 802.1x Authentication with EAP-TLS is running Fine. BUT I have the constrain that the Certificate on the Client is without "TLS Web Client Authentication" because there running absolute no Client Applications, the Device is running only some Server Applications. So I tried to Use on the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, EAP over Lan". But unfortunately the 802.1x Authentication with EAP-TLS did not work. The relevant debug Output (freeradius -X) I think is the following -------------------------CUT------------------------- Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 056b], Certificate --> verify error:num=26:unsupported certificate purpose [tls] >>> TLS 1.0 Alert [length 0002], fatal unsupported_certificate TLS Alert write:fatal:unsupported certificate TLS_accept: error in error rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect (unsupported certificate purpose): [<----->] (from client 172.23.10.172 port 3 cli 00-12-AD-00-0E-F5) Using Post-Auth-Type REJECT -------------------------CUT------------------------- I also tried using Certificates with "X509v3 Extended Key Usage" : "TLS Web Server Authentication" and "X509v3 Extended Key Usage" : " EAP over Lan" only, but the Result are the Same. My Question is know which "X509v3 Extended Key Usage" are mandatory for the Certificate on the Device? And why is it not enough that the "X509v3 Extended Key Usage" has "EAP over LAN" in it? Thanks for Help Dominik ************************************* Dipl.-Ing. (FH) Dominik Andreas Schorpp Hard und Softwareentwickler Embedded Geräte IDS GmbH E-FW - Entwicklung Ferwirktechnik Nobelstr. 18 D-76275 Ettlingen T +49 (0) 72 43/2 18-618 F +49 (0) 72 43/2 18-100 <mailto:dominik.a.schorpp@ids.de> http://www.ids.de Geschäftsführer: Harald Herrmann, Jörn Fischer, Michael Schambach Sitz der Gesellschaft: Ettlingen Amtsgericht Mannheim HRB 362503 Ein Unternehmen der IDS-Gruppe *************************************
On Dec 19, 2016, at 10:13 AM, <Dominik.A.Schorpp@ids.de> <Dominik.A.Schorpp@ids.de> wrote:
I have trouble to get 802.1x Authentication with EAP-TLS properly running.
Follow the EAP guide at: http://deployingradius.com It WILL work.
My Setup is the following: Server: FreeRADIUS Version 2.2.5, for host i586-pc-linux-gnu, built on Oct 24 2014 at 04:18:43 Switch: A NEXANS iSwitch G 1043E Client/Device: Yocto based Linux with wpa_supplicant v2.4
My Problem is the usage of the "X509v3 Extendend Key Usage" in the Certificate of the Client. If I use at the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, TLS Web Client Authentication" the 802.1x Authentication with EAP-TLS is running Fine.
You shouldn't need all that. The files in raddb/certs will create client certificates that work. Please use them.
BUT I have the constrain that the Certificate on the Client is without "TLS Web Client Authentication" because there running absolute no Client Applications, the Device is running only some Server Applications.
So I tried to Use on the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, EAP over Lan". But unfortunately the 802.1x Authentication with EAP-TLS did not work.\
Well... use the scripts included with FreeRADIUS. There's just no reason to *ignore* them. Alan DeKok.
Hello,
Follow the EAP guide at: http://deployingradius.com
It WILL work.
I have no doubt that it will not work if I follow the Guide.
My Problem is the usage of the "X509v3 Extendend Key Usage" in the Certificate of the Client. If I use at the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, TLS Web Client Authentication" the 802.1x Authentication with EAP-TLS is running Fine.
You shouldn't need all that.
The files in raddb/certs will create client certificates that work. Please use them.
I have now created a Client Certificate with the makefile in "raddb/certs", and the Certificate has the "Extended Key Usage" "TLS Web Client Authentication". As I said, a Certificate which I created by myself via "xca" and with the "Extended Key Usage" "TLS Web Server Authentication, TLS Web Client Authentication" has worked already properly. But the Final Setup will be running with Certificates which are not created by us, the Certificate will be coming from a Customer CA.
BUT I have the constrain that the Certificate on the Client is without "TLS Web Client Authentication" because there running absolute no Client Applications, the Device is running only some Server Applications.
So I tried to Use on the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, EAP over Lan". But unfortunately the 802.1x Authentication with EAP-TLS did not work.\
Well... use the scripts included with FreeRADIUS. There's just no reason to *ignore* them.
Ok, so I think with the test with Certificates created from "raddb/certs" I have know not ignored the Scripts. Know with the knowledge that this Certificate has also the "Extended Key Usage" "TLS Web Client Authentication" I conclude for my first Question:
My Question is know which "X509v3 Extended Key Usage" are mandatory for the Certificate on the Device?
That the "Extended Key Usage" "TLS Web Client Authentication" is Mandatory. But there is still my second Question, now mostly for interest.
And why is it not enough that the "X509v3 Extended Key Usage" has "EAP over LAN" in it?
Thanks Dominik
On Dec 19, 2016, at 11:18 AM, <Dominik.A.Schorpp@ids.de> <Dominik.A.Schorpp@ids.de> wrote:
Follow the EAP guide at: http://deployingradius.com
It WILL work.
I have no doubt that it will not work if I follow the Guide.
If you don't trust the experts, why are you asking questions on this list?
I have now created a Client Certificate with the makefile in "raddb/certs", and the Certificate has the "Extended Key Usage" "TLS Web Client Authentication". As I said, a Certificate which I created by myself via "xca" and with the "Extended Key Usage" "TLS Web Server Authentication, TLS Web Client Authentication" has worked already properly. But the Final Setup will be running with Certificates which are not created by us, the Certificate will be coming from a Customer CA.
If only there was some documentation on how to create certificates that work...
But there is still my second Question, now mostly for interest.
And why is it not enough that the "X509v3 Extended Key Usage" has "EAP over LAN" in it?
Ask the people who wrote the client how their client works. Alan DeKok.
Hi,
Server: FreeRADIUS Version 2.2.5, for host i586-pc-linux-gnu, built on Oct 24 2014 at 04:18:43
old. upgrade
My Problem is the usage of the "X509v3 Extendend Key Usage" in the Certificate of the Client. If I use at the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, TLS Web Client Authentication" the 802.1x Authentication with EAP-TLS is running Fine.
BUT I have the constrain that the Certificate on the Client is without "TLS Web Client Authentication" because there running absolute no Client Applications, the Device is running only some Server Applications.
So I tried to Use on the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, EAP over Lan". But unfortunately the 802.1x Authentication with EAP-TLS did not work.
latest version of FR also has latest scripts and various other things to ensure best client compatibility
My Question is know which "X509v3 Extended Key Usage" are mandatory for the Certificate on the Device?
as per the provided scripts. all very well tested with fixes and feedback given to project
And why is it not enough that the "X509v3 Extended Key Usage" has "EAP over LAN" in it?
ask microsoft and the other OS vendors who require this of their supplicants (I would also ask why a supplicant requires the OSCP value when client wont be able to be online to check!!!) alan
participants (3)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Dominik.A.Schorpp＠ids.de