On Jul 20, 2026, at 4:09 PM, Mike Diggins <diggins@mcmaster.ca> wrote:

I'm updating my FreeRADIUS environment to RHEL 10 using the RHEL-provided FreeRADIUS 3.2.8 package and the default OpenSSL version (3.5.5). For the most part, everything is working as it did before, but I have one admittedly very old MacBook Air running Sierra 10.12.6 that no longer works in the new environment. FreeRADIUS is reporting SSL/TLS errors.

Long story short, I found I could get it working by lowering what appear to be some of the new minimum SSL/TLS requirements:

OS: update-crypto-policies --set LEGACY FreeRADIUS: tls_min_version = "1.0" FreeRADIUS: cipher_list = "DEFAULT@SECLEVEL=0"

It's best to avoid TLS 1.0.

I had to drop it all the way back to TLS 1.0 for this client to work. While researching, I noticed that even this older version of macOS should (?) support TLS 1.2, so I'm trying to understand why it no longer works. My previous FreeRADIUS server was running on RHEL 7 with FreeRadius 3.0.13 and OpenSSL 1.0.2.

Ask the old MacBook Air why it's not accepting TLS 1.2. FreeRADIUS isn't forcing you to use TLS 1.0, the MacBook is choosing it. If you run FreeRADIUS in debug mode, you will see what the MacBook is sending. This information will include any TLS mismatch, complaints, etc. i.e. as *all* of the documentation suggests, if you want to see what's going on, run it in debug mode and read the output. 99% of the time, the information you want to know is in the debug output.

I'm also wondering what kind of security impact there would be if I left these settings in place. We are a large BYOD environment with many different types of clients, and I don't know how many other devices may have similar compatibility issues.

TLS 1.0 is "fine", for various insecure definitions of "fine". It will work, and you _likely_ won't be attacked. But if TLS 1.2 is out, there are no reasons to use TLS 1.0. Use TLS 1.2, it's the best security available. Alan DeKok.