Hi, while trying to setup a new Android device an issue started to appear: Short Story: Authentication fails in the (i guess) P1 phase of EAP-PEAP with a message: certificate expired. Long Story: The radius server is using LetsEncrypt Server certs for ist TLS configuration. That setups works with every device i know of in this network. A new Android device however seems to behave weird with it. Logging Freeradius with the -X flag results with the log below. The device is set to not validate the server cert and use EAP-PEAP for P1 and MSCHAPv2 for P2. kp@<domain-stripped> is the anonymous identity. The last message seems rather short (TLS Length 7) which doesn't sound right. I know there is an issue with the domain detection because its only checking for ntdomain. Thats work for another day. Thank you in advance, Daniel Lux ``` (298) Received Access-Request Id 166 from 10.2.254.253:60831 to 10.0.0.248:1812 length 208 (298) User-Name = "kp@<domain-stripped>" (298) NAS-IP-Address = 10.2.254.253 (298) NAS-Port = 0 (298) NAS-Identifier = "10.2.254.253" (298) NAS-Port-Type = Wireless-802.11 (298) Calling-Station-Id = "843E1D87F5BF" (298) Called-Station-Id = "204C03033278" (298) Service-Type = Framed-User (298) Framed-MTU = 1100 (298) EAP-Message = 0x0201001b016b70407261747367796d6e617369756d2d70652e6465 (298) Aruba-Essid-Name = "RatseNetL" (298) Aruba-Location-Id = "AP18" (298) Aruba-AP-Group = "OS-Trakt" (298) Message-Authenticator = 0xd4fead8cee934d4d691b8e1218e4220d (298) # Executing section authorize from file /etc/freeradius/sites-enabled/default (298) authorize { (298) [preprocess] = ok (298) ntdomain: Checking for prefix before "\" (298) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (298) ntdomain: No such realm "NULL" (298) [ntdomain] = noop (298) update control { (298) &Proxy-To-Realm := LOCAL (298) } # update control = noop (298) [chap] = noop (298) [mschap] = noop (298) [digest] = noop (298) eap: Peer sent EAP Response (code 2) ID 1 length 27 (298) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (298) [eap] = ok (298) } # authorize = ok (298) Found Auth-Type = eap (298) # Executing group from file /etc/freeradius/sites-enabled/default (298) authenticate { (298) eap: Peer sent packet with method EAP Identity (1) (298) eap: Calling submodule eap_peap to process data (298) eap_peap: Initiating new EAP-TLS session (298) eap_peap: [eaptls start] = request (298) eap: Sending EAP Request (code 1) ID 2 length 6 (298) eap: EAP session adding &reply:State = 0xe37f3d5de37d24b2 (298) [eap] = handled (298) } # authenticate = handled (298) Using Post-Auth-Type Challenge (298) Post-Auth-Type sub-section not found. Ignoring. (298) # Executing group from file /etc/freeradius/sites-enabled/default (298) Sent Access-Challenge Id 166 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (298) EAP-Message = 0x010200061920 (298) Message-Authenticator = 0x00000000000000000000000000000000 (298) State = 0xe37f3d5de37d24b242773e627ff3f802 (298) Finished request (299) Received Access-Request Id 47 from 10.2.254.253:60831 to 10.0.0.248:1812 length 340 (299) User-Name = "kp@<domain-stripped>" (299) NAS-IP-Address = 10.2.254.253 (299) NAS-Port = 0 (299) NAS-Identifier = "10.2.254.253" (299) NAS-Port-Type = Wireless-802.11 (299) Calling-Station-Id = "843E1D87F5BF" (299) Called-Station-Id = "204C03033278" (299) Service-Type = Framed-User (299) Framed-MTU = 1100 (299) EAP-Message = 0x0202008d198000000083160301007e0100007a03039cd3aa393b421414e62481d34c86e861 c1dd382868b4f29944d0c04c62ae43ec00001ec02bc02fc02cc030cca9cca8c009c013c00ac0 14009c009d002f0035000a0100003300170000ff01000100000a00080006001d00170018000b 00020100000d (299) State = 0xe37f3d5de37d24b242773e627ff3f802 (299) Aruba-Essid-Name = "RatseNetL" (299) Aruba-Location-Id = "AP18" (299) Aruba-AP-Group = "OS-Trakt" (299) Message-Authenticator = 0x6761200777d3cba4c291bc097f235982 (299) session-state: No cached attributes (299) # Executing section authorize from file /etc/freeradius/sites-enabled/default (299) authorize { (299) [preprocess] = ok (299) ntdomain: Checking for prefix before "\" (299) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (299) ntdomain: No such realm "NULL" (299) [ntdomain] = noop (299) update control { (299) &Proxy-To-Realm := LOCAL (299) } # update control = noop (299) [chap] = noop (299) [mschap] = noop (299) [digest] = noop (299) eap: Peer sent EAP Response (code 2) ID 2 length 141 (299) eap: Continuing tunnel setup (299) [eap] = ok (299) } # authorize = ok (299) Found Auth-Type = eap (299) # Executing group from file /etc/freeradius/sites-enabled/default (299) authenticate { (299) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (299) eap: Finished EAP session with state 0xe37f3d5de37d24b2 (299) eap: Previous EAP request found for state 0xe37f3d5de37d24b2, released from the list (299) eap: Peer sent packet with method EAP PEAP (25) (299) eap: Calling submodule eap_peap to process data (299) eap_peap: Continuing EAP-TLS (299) eap_peap: Peer indicated complete TLS record size will be 131 bytes (299) eap_peap: Got complete TLS record (131 bytes) (299) eap_peap: [eaptls verify] = length included (299) eap_peap: (other): before/accept initialization (299) eap_peap: TLS_accept: before/accept initialization (299) eap_peap: <<< recv TLS 1.2 [length 007e] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 0039] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 149f] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 014d] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 0004] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: Need to read more data: unknown state (299) eap_peap: TLS_accept: Need to read more data: unknown state (299) eap_peap: In SSL Handshake Phase (299) eap_peap: In SSL Accept mode (299) eap_peap: [eaptls process] = handled (299) eap: Sending EAP Request (code 1) ID 3 length 1004 (299) eap: EAP session adding &reply:State = 0xe37f3d5de27c24b2 (299) [eap] = handled (299) } # authenticate = handled (299) Using Post-Auth-Type Challenge (299) Post-Auth-Type sub-section not found. Ignoring. (299) # Executing group from file /etc/freeradius/sites-enabled/default (299) Sent Access-Challenge Id 47 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (299) EAP-Message = 0x010303ec19c00000163d16030300390200003503032221981d91de057e15a5d627e7d85254 fb02778827cee35a6895f65d00e6180c00c02f00000dff01000100000b000403000102160303 149f0b00149b001498000a1130820a0d308208f5a00302010202120314c38ef6206d2a5d13b5 c8cb45752f9f (299) Message-Authenticator = 0x00000000000000000000000000000000 (299) State = 0xe37f3d5de27c24b242773e627ff3f802 (299) Finished request (240) Cleaning up request packet ID 111 with timestamp +10 (241) Cleaning up request packet ID 60 with timestamp +10 (300) Received Access-Request Id 62 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (300) User-Name = "kp@<domain-stripped>" (300) NAS-IP-Address = 10.2.254.253 (300) NAS-Port = 0 (300) NAS-Identifier = "10.2.254.253" (300) NAS-Port-Type = Wireless-802.11 (300) Calling-Station-Id = "843E1D87F5BF" (300) Called-Station-Id = "204C03033278" (300) Service-Type = Framed-User (300) Framed-MTU = 1100 (300) EAP-Message = 0x020300061900 (300) State = 0xe37f3d5de27c24b242773e627ff3f802 (300) Aruba-Essid-Name = "RatseNetL" (300) Aruba-Location-Id = "AP18" (300) Aruba-AP-Group = "OS-Trakt" (300) Message-Authenticator = 0x808be1cbe0d6892e798f1d3413c760b5 (300) session-state: No cached attributes (300) # Executing section authorize from file /etc/freeradius/sites-enabled/default (300) authorize { (300) [preprocess] = ok (300) ntdomain: Checking for prefix before "\" (300) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (300) ntdomain: No such realm "NULL" (300) [ntdomain] = noop (300) update control { (300) &Proxy-To-Realm := LOCAL (300) } # update control = noop (300) [chap] = noop (300) [mschap] = noop (300) [digest] = noop (300) eap: Peer sent EAP Response (code 2) ID 3 length 6 (300) eap: Continuing tunnel setup (300) [eap] = ok (300) } # authorize = ok (300) Found Auth-Type = eap (300) # Executing group from file /etc/freeradius/sites-enabled/default (300) authenticate { (300) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (300) eap: Finished EAP session with state 0xe37f3d5de27c24b2 (300) eap: Previous EAP request found for state 0xe37f3d5de27c24b2, released from the list (300) eap: Peer sent packet with method EAP PEAP (25) (300) eap: Calling submodule eap_peap to process data (300) eap_peap: Continuing EAP-TLS (300) eap_peap: Peer ACKed our handshake fragment (300) eap_peap: [eaptls verify] = request (300) eap_peap: [eaptls process] = handled (300) eap: Sending EAP Request (code 1) ID 4 length 1000 (300) eap: EAP session adding &reply:State = 0xe37f3d5de17b24b2 (300) [eap] = handled (300) } # authenticate = handled (300) Using Post-Auth-Type Challenge (300) Post-Auth-Type sub-section not found. Ignoring. (300) # Executing group from file /etc/freeradius/sites-enabled/default (300) Sent Access-Challenge Id 62 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (300) EAP-Message = 0x010403e8194069756d2d70652e6465821b686170726f78792e7261747367796d6e61736975 6d2d70652e64658218686f6d652e7261747367796d6e617369756d2d70652e64658218696d61 702e7261747367796d6e617369756d2d70652e6465821d696e666f62726574742e7261747367 796d6e617369 (300) Message-Authenticator = 0x00000000000000000000000000000000 (300) State = 0xe37f3d5de17b24b242773e627ff3f802 (300) Finished request (242) Cleaning up request packet ID 16 with timestamp +10 (301) Received Access-Request Id 64 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (301) User-Name = "kp@<domain-stripped>" (301) NAS-IP-Address = 10.2.254.253 (301) NAS-Port = 0 (301) NAS-Identifier = "10.2.254.253" (301) NAS-Port-Type = Wireless-802.11 (301) Calling-Station-Id = "843E1D87F5BF" (301) Called-Station-Id = "204C03033278" (301) Service-Type = Framed-User (301) Framed-MTU = 1100 (301) EAP-Message = 0x020400061900 (301) State = 0xe37f3d5de17b24b242773e627ff3f802 (301) Aruba-Essid-Name = "RatseNetL" (301) Aruba-Location-Id = "AP18" (301) Aruba-AP-Group = "OS-Trakt" (301) Message-Authenticator = 0x87340687e4ff778e7567a60a6fad3440 (301) session-state: No cached attributes (301) # Executing section authorize from file /etc/freeradius/sites-enabled/default (301) authorize { (301) [preprocess] = ok (301) ntdomain: Checking for prefix before "\" (301) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (301) ntdomain: No such realm "NULL" (301) [ntdomain] = noop (301) update control { (301) &Proxy-To-Realm := LOCAL (301) } # update control = noop (301) [chap] = noop (301) [mschap] = noop (301) [digest] = noop (301) eap: Peer sent EAP Response (code 2) ID 4 length 6 (301) eap: Continuing tunnel setup (301) [eap] = ok (301) } # authorize = ok (301) Found Auth-Type = eap (301) # Executing group from file /etc/freeradius/sites-enabled/default (301) authenticate { (301) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (301) eap: Finished EAP session with state 0xe37f3d5de17b24b2 (301) eap: Previous EAP request found for state 0xe37f3d5de17b24b2, released from the list (301) eap: Peer sent packet with method EAP PEAP (25) (301) eap: Calling submodule eap_peap to process data (301) eap_peap: Continuing EAP-TLS (301) eap_peap: Peer ACKed our handshake fragment (301) eap_peap: [eaptls verify] = request (301) eap_peap: [eaptls process] = handled (301) eap: Sending EAP Request (code 1) ID 5 length 1000 (301) eap: EAP session adding &reply:State = 0xe37f3d5de07a24b2 (301) [eap] = handled (301) } # authenticate = handled (301) Using Post-Auth-Type Challenge (301) Post-Auth-Type sub-section not found. Ignoring. (301) # Executing group from file /etc/freeradius/sites-enabled/default (301) Sent Access-Challenge Id 64 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (301) EAP-Message = 0x010503e81940796d6e617369756d2d70652e64658223776c616e2d636f6e74726f6c6c6572 2e7261747367796d6e617369756d2d70652e646582177777772e7261747367796d6e61736975 6d2d70652e6465821a7a61626269782e7261747367796d6e617369756d2d70652e6465301306 03551d20040c (301) Message-Authenticator = 0x00000000000000000000000000000000 (301) State = 0xe37f3d5de07a24b242773e627ff3f802 (301) Finished request (302) Received Access-Request Id 52 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (302) User-Name = "kp@<domain-stripped>" (302) NAS-IP-Address = 10.2.254.253 (302) NAS-Port = 0 (302) NAS-Identifier = "10.2.254.253" (302) NAS-Port-Type = Wireless-802.11 (302) Calling-Station-Id = "843E1D87F5BF" (302) Called-Station-Id = "204C03033278" (302) Service-Type = Framed-User (302) Framed-MTU = 1100 (302) EAP-Message = 0x020500061900 (302) State = 0xe37f3d5de07a24b242773e627ff3f802 (302) Aruba-Essid-Name = "RatseNetL" (302) Aruba-Location-Id = "AP18" (302) Aruba-AP-Group = "OS-Trakt" (302) Message-Authenticator = 0xa55c00579b9ed3c4554238f83309a7be (302) session-state: No cached attributes (302) # Executing section authorize from file /etc/freeradius/sites-enabled/default (302) authorize { (302) [preprocess] = ok (302) ntdomain: Checking for prefix before "\" (302) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (302) ntdomain: No such realm "NULL" (302) [ntdomain] = noop (302) update control { (302) &Proxy-To-Realm := LOCAL (302) } # update control = noop (302) [chap] = noop (302) [mschap] = noop (302) [digest] = noop (302) eap: Peer sent EAP Response (code 2) ID 5 length 6 (302) eap: Continuing tunnel setup (302) [eap] = ok (302) } # authorize = ok (302) Found Auth-Type = eap (302) # Executing group from file /etc/freeradius/sites-enabled/default (302) authenticate { (302) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (302) eap: Finished EAP session with state 0xe37f3d5de07a24b2 (302) eap: Previous EAP request found for state 0xe37f3d5de07a24b2, released from the list (302) eap: Peer sent packet with method EAP PEAP (25) (302) eap: Calling submodule eap_peap to process data (302) eap_peap: Continuing EAP-TLS (302) eap_peap: Peer ACKed our handshake fragment (302) eap_peap: [eaptls verify] = request (302) eap_peap: [eaptls process] = handled (302) eap: Sending EAP Request (code 1) ID 6 length 1000 (302) eap: EAP session adding &reply:State = 0xe37f3d5de77924b2 (302) [eap] = handled (302) } # authenticate = handled (302) Using Post-Auth-Type Challenge (302) Post-Auth-Type sub-section not found. Ignoring. (302) # Executing group from file /etc/freeradius/sites-enabled/default (302) Sent Access-Challenge Id 52 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (302) EAP-Message = 0x010603e819400b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34 c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f8 30175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60 677566b3f118 (302) Message-Authenticator = 0x00000000000000000000000000000000 (302) State = 0xe37f3d5de77924b242773e627ff3f802 (302) Finished request (243) Cleaning up request packet ID 156 with timestamp +10 Waking up in 0.9 seconds. (303) Received Access-Request Id 130 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (303) User-Name = "kp@<domain-stripped>" (303) NAS-IP-Address = 10.2.254.253 (303) NAS-Port = 0 (303) NAS-Identifier = "10.2.254.253" (303) NAS-Port-Type = Wireless-802.11 (303) Calling-Station-Id = "843E1D87F5BF" (303) Called-Station-Id = "204C03033278" (303) Service-Type = Framed-User (303) Framed-MTU = 1100 (303) EAP-Message = 0x020600061900 (303) State = 0xe37f3d5de77924b242773e627ff3f802 (303) Aruba-Essid-Name = "RatseNetL" (303) Aruba-Location-Id = "AP18" (303) Aruba-AP-Group = "OS-Trakt" (303) Message-Authenticator = 0x718692290105f2acae5e8598d3db3aad (303) session-state: No cached attributes (303) # Executing section authorize from file /etc/freeradius/sites-enabled/default (303) authorize { (303) [preprocess] = ok (303) ntdomain: Checking for prefix before "\" (303) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (303) ntdomain: No such realm "NULL" (303) [ntdomain] = noop (303) update control { (303) &Proxy-To-Realm := LOCAL (303) } # update control = noop (303) [chap] = noop (303) [mschap] = noop (303) [digest] = noop (303) eap: Peer sent EAP Response (code 2) ID 6 length 6 (303) eap: Continuing tunnel setup (303) [eap] = ok (303) } # authorize = ok (303) Found Auth-Type = eap (303) # Executing group from file /etc/freeradius/sites-enabled/default (303) authenticate { (303) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (303) eap: Finished EAP session with state 0xe37f3d5de77924b2 (303) eap: Previous EAP request found for state 0xe37f3d5de77924b2, released from the list (303) eap: Peer sent packet with method EAP PEAP (25) (303) eap: Calling submodule eap_peap to process data (303) eap_peap: Continuing EAP-TLS (303) eap_peap: Peer ACKed our handshake fragment (303) eap_peap: [eaptls verify] = request (303) eap_peap: [eaptls process] = handled (303) eap: Sending EAP Request (code 1) ID 7 length 1000 (303) eap: EAP session adding &reply:State = 0xe37f3d5de67824b2 (303) [eap] = handled (303) } # authenticate = handled (303) Using Post-Auth-Type Challenge (303) Post-Auth-Type sub-section not found. Ignoring. (303) # Executing group from file /etc/freeradius/sites-enabled/default (303) Sent Access-Challenge Id 130 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (303) EAP-Message = 0x010703e8194002010202104001772137d4e942b8ee76aa3c640ab7300d06092a864886f70d 01010b0500303f31243022060355040a131b4469676974616c205369676e6174757265205472 75737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3231 303132303139 (303) Message-Authenticator = 0x00000000000000000000000000000000 (303) State = 0xe37f3d5de67824b242773e627ff3f802 (303) Finished request Waking up in 0.8 seconds. (304) Received Access-Request Id 7 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (304) User-Name = "kp@<domain-stripped>" (304) NAS-IP-Address = 10.2.254.253 (304) NAS-Port = 0 (304) NAS-Identifier = "10.2.254.253" (304) NAS-Port-Type = Wireless-802.11 (304) Calling-Station-Id = "843E1D87F5BF" (304) Called-Station-Id = "204C03033278" (304) Service-Type = Framed-User (304) Framed-MTU = 1100 (304) EAP-Message = 0x020700061900 (304) State = 0xe37f3d5de67824b242773e627ff3f802 (304) Aruba-Essid-Name = "RatseNetL" (304) Aruba-Location-Id = "AP18" (304) Aruba-AP-Group = "OS-Trakt" (304) Message-Authenticator = 0x2c0fc1bf87744bffe4e874075c9484f0 (304) session-state: No cached attributes (304) # Executing section authorize from file /etc/freeradius/sites-enabled/default (304) authorize { (304) [preprocess] = ok (304) ntdomain: Checking for prefix before "\" (304) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (304) ntdomain: No such realm "NULL" (304) [ntdomain] = noop (304) update control { (304) &Proxy-To-Realm := LOCAL (304) } # update control = noop (304) [chap] = noop (304) [mschap] = noop (304) [digest] = noop (304) eap: Peer sent EAP Response (code 2) ID 7 length 6 (304) eap: Continuing tunnel setup (304) [eap] = ok (304) } # authorize = ok (304) Found Auth-Type = eap (304) # Executing group from file /etc/freeradius/sites-enabled/default (304) authenticate { (304) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (304) eap: Finished EAP session with state 0xe37f3d5de67824b2 (304) eap: Previous EAP request found for state 0xe37f3d5de67824b2, released from the list (304) eap: Peer sent packet with method EAP PEAP (25) (304) eap: Calling submodule eap_peap to process data (304) eap_peap: Continuing EAP-TLS (304) eap_peap: Peer ACKed our handshake fragment (304) eap_peap: [eaptls verify] = request (304) eap_peap: [eaptls process] = handled (304) eap: Sending EAP Request (code 1) ID 8 length 729 (304) eap: EAP session adding &reply:State = 0xe37f3d5de57724b2 (304) [eap] = handled (304) } # authenticate = handled (304) Using Post-Auth-Type Challenge (304) Post-Auth-Type sub-section not found. Ignoring. (304) # Executing group from file /etc/freeradius/sites-enabled/default (304) Sent Access-Challenge Id 7 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (304) EAP-Message = 0x010802d919007970742e6f7267303c0603551d1f043530333031a02fa02d862b687474703a 2f2f63726c2e6964656e74727573742e636f6d2f445354524f4f544341583343524c2e63726c 301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a8648 86f70d01010b (304) Message-Authenticator = 0x00000000000000000000000000000000 (304) State = 0xe37f3d5de57724b242773e627ff3f802 (304) Finished request Waking up in 0.8 seconds. (305) Received Access-Request Id 157 from 10.2.254.253:60831 to 10.0.0.248:1812 length 216 (305) User-Name = "kp@<domain-stripped>" (305) NAS-IP-Address = 10.2.254.253 (305) NAS-Port = 0 (305) NAS-Identifier = "10.2.254.253" (305) NAS-Port-Type = Wireless-802.11 (305) Calling-Station-Id = "843E1D87F5BF" (305) Called-Station-Id = "204C03033278" (305) Service-Type = Framed-User (305) Framed-MTU = 1100 (305) EAP-Message = 0x020800111980000000071503030002022d (305) State = 0xe37f3d5de57724b242773e627ff3f802 (305) Aruba-Essid-Name = "RatseNetL" (305) Aruba-Location-Id = "AP18" (305) Aruba-AP-Group = "OS-Trakt" (305) Message-Authenticator = 0x2db17bbdf81f36dcb1577a0066f224d2 (305) session-state: No cached attributes (305) # Executing section authorize from file /etc/freeradius/sites-enabled/default (305) authorize { (305) [preprocess] = ok (305) ntdomain: Checking for prefix before "\" (305) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (305) ntdomain: No such realm "NULL" (305) [ntdomain] = noop (305) update control { (305) &Proxy-To-Realm := LOCAL (305) } # update control = noop (305) [chap] = noop (305) [mschap] = noop (305) [digest] = noop (305) eap: Peer sent EAP Response (code 2) ID 8 length 17 (305) eap: Continuing tunnel setup (305) [eap] = ok (305) } # authorize = ok (305) Found Auth-Type = eap (305) # Executing group from file /etc/freeradius/sites-enabled/default (305) authenticate { (305) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (305) eap: Finished EAP session with state 0xe37f3d5de57724b2 (305) eap: Previous EAP request found for state 0xe37f3d5de57724b2, released from the list (305) eap: Peer sent packet with method EAP PEAP (25) (305) eap: Calling submodule eap_peap to process data (305) eap_peap: Continuing EAP-TLS (305) eap_peap: Peer indicated complete TLS record size will be 7 bytes (305) eap_peap: Got complete TLS record (7 bytes) (305) eap_peap: [eaptls verify] = length included (305) eap_peap: <<< recv TLS 1.2 [length 0002] (305) eap_peap: ERROR: TLS Alert read:fatal:certificate expired (305) eap_peap: ERROR: TLS_accept: Failed in error (305) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) (305) eap_peap: ERROR: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired (305) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure (305) eap_peap: ERROR: System call (I/O) error (-1) (305) eap_peap: ERROR: TLS receive handshake failed during operation (305) eap_peap: ERROR: [eaptls process] = fail (305) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (305) eap: Sending EAP Failure (code 4) ID 8 length 4 (305) eap: Failed in EAP select (305) [eap] = invalid (305) } # authenticate = invalid (305) Failed to authenticate the user (305) Using Post-Auth-Type Reject (305) Post-Auth-Type sub-section not found. Ignoring. (305) # Executing group from file /etc/freeradius/sites-enabled/default (305) Login incorrect (eap_peap: TLS Alert read:fatal:certificate expired): [kp@<domain-stripped>/<via Auth-Type = eap>] (from client wlan_controller port 0 cli 843E1D87F5BF) (305) Delaying response for 1.000000 seconds ```