SSL certificate problems
List, I am following the document "FreeRADIUS Active Directory Integration HOWTO" from the freeradius Wiki. I am having problems with creating SSL certificates. When I follow the instructions at the bottom of this doc and run the CA.all script, I see the following errors: + openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:removed -passout pass:removed Error opening input file demoCA/cacert.pem demoCA/cacert.pem: No such file or directory + openssl pkcs12 -in root.p12 -out root.pem -passin pass:removed -passout pass:removed Error opening input file root.p12 root.p12: No such file or directory + openssl x509 -inform PEM -outform DER -in root.pem -out root.der Error opening Certificate root.pem 3925:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('root.pem','r') 3925:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: unable to load certificate I saw a mailing list posting that said to move the CA.all script and the xpextensions file to the /etc/raddb/certs directory and run it from there, however after doing that I still receive the same errors. Anybody have any ideas on this? After googling awhile, it seems like this might be an openssl syntax error w/in the script. Also, I am using FreeRADIUS 1.1.3 (CentOS rpm install). Thanks, Walter
Walter Gould wrote:
I am following the document "FreeRADIUS Active Directory Integration HOWTO" from the freeradius Wiki. I am having problems with creating SSL certificates. When I follow the instructions at the bottom of this doc and run the CA.all script, I see the following errors:
Ugh. Download CVS head (see the web page for CVS instructions). $ cd raddb/certs $ vi *.cnf ca.cnf, server.cnf to set your local parameters $ ./bootstrap And you will have certificates than can be used in 1.1.x. Alan DeKok.
Alan DeKok wrote:
Walter Gould wrote:
I am following the document "FreeRADIUS Active Directory Integration HOWTO" from the freeradius Wiki. I am having problems with creating SSL certificates. When I follow the instructions at the bottom of this doc and run the CA.all script, I see the following errors:
Ugh.
Download CVS head (see the web page for CVS instructions).
$ cd raddb/certs $ vi *.cnf ca.cnf, server.cnf to set your local parameters $ ./bootstrap
And you will have certificates than can be used in 1.1.x.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan, Thanks for your help. I did what you suggested and then copied the certs that were created to my /etc/raddb/certs directory. Also, I edited eap.conf to match the new private key password and the newly created certificate names. I now try to run radiusd in debug mode and it dies. I have checked file/directory permissions on the certs directory and they look ok to me - of course I know that doesn't mean much... Below is the debug. Please let me know if you need anything else... Thanks again, Walter Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server.pem" tls: certificate_file = "/etc/raddb/certs/server.pem" tls: CA_file = "/etc/raddb/certs/ca.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1947] Unknown module "eap". radiusd.conf[1894] Failed to parse authenticate section.
Walter Gould wrote:
Alan DeKok wrote:
Walter Gould wrote:
I am following the document "FreeRADIUS Active Directory Integration HOWTO" from the freeradius Wiki. I am having problems with creating SSL certificates. When I follow the instructions at the bottom of this doc and run the CA.all script, I see the following errors:
Ugh.
Download CVS head (see the web page for CVS instructions).
$ cd raddb/certs $ vi *.cnf ca.cnf, server.cnf to set your local parameters $ ./bootstrap
And you will have certificates than can be used in 1.1.x.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan,
Thanks for your help. I did what you suggested and then copied the certs that were created to my /etc/raddb/certs directory. Also, I edited eap.conf to match the new private key password and the newly created certificate names. I now try to run radiusd in debug mode and it dies. I have checked file/directory permissions on the certs directory and they look ok to me - of course I know that doesn't mean much...
Below is the debug. Please let me know if you need anything else...
Thanks again, Walter
Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server.pem" tls: certificate_file = "/etc/raddb/certs/server.pem" tls: CA_file = "/etc/raddb/certs/ca.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1947] Unknown module "eap". radiusd.conf[1894] Failed to parse authenticate section.
Alan & list, Ignore my previous e-mail. It was indeed a permissions problem. Thanks again, Walter -- Walter P. Gould Info. Tech. Specialist Office of Information Technology Auburn University, AL gouldwp@auburn.edu www.auburn.edu/~gouldwp 334-844-9327
Alan DeKok wrote:
Walter Gould wrote:
I am following the document "FreeRADIUS Active Directory Integration HOWTO" from the freeradius Wiki. I am having problems with creating SSL certificates. When I follow the instructions at the bottom of this doc and run the CA.all script, I see the following errors:
Ugh.
Download CVS head (see the web page for CVS instructions).
$ cd raddb/certs $ vi *.cnf ca.cnf, server.cnf to set your local parameters $ ./bootstrap
And you will have certificates than can be used in 1.1.x.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Alan & list, Sorry to bother you guys again - I created new SSL certificates per your above instructions... After the certs were created, I then: 1. copied them to the /etc/raddb/certs directory 2. updated /etc/raddb/eap.conf with the certificate names & private key password 3. copied and installed the new certificate (server.pem) onto my XP laptop and 4. started radiusd in debug mode, below is the output It is acting as you describe in the FAQ - "the client sends a series of Access-Request messages, the server sends an series of Access-Challenge responses, and then... nothing happens. After a little wait, it all starts again." So, I am wondering will I need to install the hotfix as listed in the FAQ - and, will this have to be done on ALL Windows machines? I am thinking that I still do not have something configured right on my side. If I uncheck the "validate server certs" box on the XP client, I can connect and authenticate successfully. Thanks again - Walter Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server.pem" tls: certificate_file = "/etc/raddb/certs/server.pem" tls: CA_file = "/etc/raddb/certs/ca.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 131.204.xx.xx:1645, id=60, length=221 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0011.2059.66f0" Calling-Station-Id = "0016.ce3a.fe00" Service-Type = Login-User Message-Authenticator = 0xfa42a088611ca8553c138461a5e37da9 EAP-Message = 0x0203005019800000004616030100410100003d03014725fcbbd1cb646792d9608deda83403db296d7cd4d986561c01f5831c20acc500001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 1409 State = 0x727730e02c5807c72421f7f8e37c09ef NAS-IP-Address = 131.204.xx.xx NAS-Identifier = "RadiusTest" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 079c], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 60 to 131.204.xx.xx port 1645 EAP-Message = 0x0104040a19c0000007f9160301004a0200004603014725fd713883c033611cb8b22760eadd8dc008b3777cee4deeb42e53a23e662c203b8004b2a236f218a339af08991fe4da34e9a6afbdf745661c23ec631dd524d6000400160301079c0b0007980007950003bd308203b9308202a1a003020102020101300d06092a864886f70d01010405003081a8310b30090603550406130255533110300e06035504081307416c6162616d61311a30180603550407131141756275726e20556e69766572736974793120301e060355040a13174f4954202d2041756275726e20556e69766572736974793121301f06092a864886f70d0109011612676f756c64 EAP-Message = 0x77704061756275726e2e656475312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3037313032363138343132335a170d3038313032353138343132335a307e310b30090603550406130255533110300e06035504081307416c6162616d613120301e060355040a13174f4954202d2041756275726e20556e6976657273697479311830160603550403130f726164322e61756275726e2e6564753121301f06092a864886f70d0109011612676f756c6477704061756275726e2e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100cce2a7fd4a1386 EAP-Message = 0xfc43465e2bdba907a0d05c91d17eddb51fde1e39d67ac9253e45d03b5a1d726807f29a41b4ffd828fd4a6a68ae665f1d23ff5ee598ed1c9733a5dc52e149a884d0683b09d90626c47e1346882b4a3758062bfbc81d11014cafdd8ae5fe5b6fbbf2f0cdbe876c626436c3c596b09a179763a3a67d5876dae7ec67bc7df8c61d9307a46597d0cd673673b1b614badfa12eb3fc44c3f9aaa29a355d8e0bf01e386616ee92b8d1a4e97d58a3ef509b08cc1e20390631cf6d744f7c76ffc560388f152c2e4e6eddd46c114f9e06711f04e9efc62138b7b37f13585063d3dcfd5c769a41c37927b033bbb8131904039cc7a611c4510b280b2b36bdbf02030100 EAP-Message = 0x01a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010074cb061838250e4537f80ee16b67a74169886627eae00e18f6a7e8f3e72350d94f286b0599abd0fbd9748b70e2b3d9d044ff342a8f77de5fa4b0b227fc3c453b624d48840b9f2637280592ac20c1a5697a23eb72af6b3fe9ca0ca7bdd7f44a9eb98b8844677107006919a9c7131deca44312d1897c3091564ff915e3f688231ba6207a77e824c3225b3b7e46e1d19d5e4cd7106fcc5a26a0ae848083af27b415d7c419f6d5ecab383d015148f51464464efc8fc248e02a3c341f2011b476100c25c61b18878b7f8b29923bbf6f1cfb EAP-Message = 0x8af640e1e0303b4951607ff084645a1042980ebec1af Message-Authenticator = 0x00000000000000000000000000000000 State = 0x91c30afa94d34c8fd79ff73e842f10d2 Finished request 1 Going to the next request Waking up in 6 seconds...
Walter Gould wrote:
Sorry to bother you guys again - I created new SSL certificates per your above instructions... After the certs were created, I then:
1. copied them to the /etc/raddb/certs directory 2. updated /etc/raddb/eap.conf with the certificate names & private key password 3. copied and installed the new certificate (server.pem) onto my XP laptop and 4. started radiusd in debug mode, below is the output
It is acting as you describe in the FAQ -
You didn't add the root certificate to the XP machine. See the EAP-TLS "howto's" on the web site.
So, I am wondering will I need to install the hotfix as listed in the FAQ - and, will this have to be done on ALL Windows machines? I am thinking that I still do not have something configured right on my side. If I uncheck the "validate server certs" box on the XP client, I can connect and authenticate successfully.
Yup. "Ignore that we have no idea where this certificate came from, and do PEAP anyways". Alan DeKok.
Alan DeKok wrote:
Walter Gould wrote:
Sorry to bother you guys again - I created new SSL certificates per your above instructions... After the certs were created, I then:
1. copied them to the /etc/raddb/certs directory 2. updated /etc/raddb/eap.conf with the certificate names & private key password 3. copied and installed the new certificate (server.pem) onto my XP laptop and 4. started radiusd in debug mode, below is the output
It is acting as you describe in the FAQ -
You didn't add the root certificate to the XP machine. See the EAP-TLS "howto's" on the web site.
Thanks Alan - once I did this, it worked. I had the root certificate (ca.pem) confused with one of the other certs. The SSL certificate terminology is bit crazy to me... thanks again, Walter
participants (2)
-
Alan DeKok -
Walter Gould