alert bad certificate with Windows XP
Hello, I am using a certificate from incommon for eap/peap setup. It works with Windows 7 when validate certificate is enabled but not with Windows XP. Windows XP works only without the certificate validation. Following is the error that I am getting with Windows XP system: [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate SSL: SSL_read failed inside of TLS (-1), TLS session fails. Do we need to do something special for Windows XP systems? Thanks in advance, Angela
Angelica Delgado wrote:
I am using a certificate from incommon for eap/peap setup. It works with Windows 7 when validate certificate is enabled but not with Windows XP. Windows XP works only without the certificate validation. Following is the error that I am getting with Windows XP system:
Well... that's XP.
Do we need to do something special for Windows XP systems?
No. PEAP works with XP. Lots of people use it. Follow the guidelines to create certificates for PEAP. http://deployingradius.com It contains *detailed* instructions for how to track down the problem. Alan DeKok.
Does peap needs xpextensions even though we are not using client certficates? I got the certificate from Incommon cert service. Thanks. On Wed, Dec 14, 2011 at 3:34 AM, Alan DeKok <aland@deployingradius.com>wrote:
Angelica Delgado wrote:
I am using a certificate from incommon for eap/peap setup. It works with Windows 7 when validate certificate is enabled but not with Windows XP. Windows XP works only without the certificate validation. Following is the error that I am getting with Windows XP system:
Well... that's XP.
Do we need to do something special for Windows XP systems?
No. PEAP works with XP. Lots of people use it.
Follow the guidelines to create certificates for PEAP. http://deployingradius.com
It contains *detailed* instructions for how to track down the problem.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Angelica Delgado wrote:
Does peap needs xpextensions
YES. ALWAYS YES.
even though we are not using client certficates? I got the certificate from Incommon cert service.
So you didn't follow the instructions on how to create certificates, and you didn't read the many documents which say it WILL NOT WORK without the XP extensions. Alan DeKok.
Thanks for the help, I will redo the certificates. On Wed, Dec 14, 2011 at 10:39 AM, Alan DeKok <aland@deployingradius.com>wrote:
Angelica Delgado wrote:
Does peap needs xpextensions
YES. ALWAYS YES.
even though we are not using client certficates? I got the certificate from Incommon cert service.
So you didn't follow the instructions on how to create certificates, and you didn't read the many documents which say it WILL NOT WORK without the XP extensions.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Does the SSID needs to match the common name of the certificate or it can be an alternative subject? Thanks. Angela On Wed, Dec 14, 2011 at 11:42 AM, Angelica Delgado <angelicadel230@gmail.com
wrote:
Thanks for the help, I will redo the certificates.
On Wed, Dec 14, 2011 at 10:39 AM, Alan DeKok <aland@deployingradius.com>wrote:
Angelica Delgado wrote:
Does peap needs xpextensions
YES. ALWAYS YES.
even though we are not using client certficates? I got the certificate from Incommon cert service.
So you didn't follow the instructions on how to create certificates, and you didn't read the many documents which say it WILL NOT WORK without the XP extensions.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Can you please provide a URL that I can use for reference? Thanks On Wed, Dec 14, 2011 at 4:24 PM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Does the SSID needs to match the common name of the certificate or it can be an alternative subject?
SSID has nothing to do with it - its the CN from the RADIUS server that needs to match in your 802.1X settings on the client
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I want to know which reference I can use to make a certicate request for a third party ca. This certificate is for peap with mschap v2. In terms of adding the extensions for peap. Thanks. On Dec 14, 2011 5:48 PM, "Alan Buxey" <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Can you please provide a URL that I can use for reference?
what is it that you need or want? the RFC for 802.1X authentications via the EAP methods? Is there a particular issue you are trying to resolve here?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Angelica Delgado wrote:
I want to know which reference I can use to make a certicate request for a third party ca. This certificate is for peap with mschap v2. In terms of adding the extensions for peap.
Microsoft has web pages on this. READ eap.conf. It explains this in excruciating detail. Reading the docs is simpler and faster than posting 1-line vague questions on this list. Alan DeKok.
Hi,
I want to know which reference I can use to make a certicate request for a third party ca.� This certificate is for peap with mschap v2.� In terms of adding the extensions for peap.
http://support.microsoft.com/kb/814394/en-us you know, this is written in plain clear text in 'xpextensions' file in the certs directory - which I'm sure you've looked at when generating your initial cert? alan
participants (3)
-
Alan Buxey -
Alan DeKok -
Angelica Delgado