Ipad 7.0.4 EAP-TTLS PAP Problem
Hi there, I've got some issue with ipad device. I have settings EAP-TTLS PAP with working fine certificate tested on Windows (7,8,8.1), Android etc. Certificate is from TERENA (Root AdTrust certificate). When i want to connect from ipad with 7.0.3(11B511) version of firmware i can't connect and in logs i have something like that: Oct 1 13:06:38 radius radiusd[8232]: TLS Alert read:warning:close notify Oct 1 13:06:38 radius radiusd[8232]: TLS_accept: failed in SSLv3 read client certificate A Oct 1 13:06:38 radius radiusd[8232]: rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure Oct 1 13:06:38 radius radiusd[8232]: SSL: SSL_read failed in a system call (-1), TLS session fails. Any other systems this certificate work fine. Tnx for reply Thomas
Puzzel wrote:
When i want to connect from ipad with 7.0.3(11B511) version of firmware i can't connect and in logs i have something like that:
Oct 1 13:06:38 radius radiusd[8232]: TLS Alert read:warning:close notify
Oct 1 13:06:38 radius radiusd[8232]: TLS_accept: failed in SSLv3 read client certificate A
Oct 1 13:06:38 radius radiusd[8232]: rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure
That's an OpenSSL issue. FreeRADIUS just uses OpenSSL to do all of the TLS / SSL work. We don't implement SSL ourselves.
Any other systems this certificate work fine.
Check the OpenSSL library versions. The working machine will have a different version than the non-working machine. So... update the non-working machine to the working version of OpenSSL. Alan DeKok.
It looks like ipads (and maybe other apple devices) needs Root and all intermediate certificates. Maybe it's some kind of bug i don't know, but i solved it this way and device connect properly (ipad mini soft 7.0.3). -----Original Message----- From: freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius.org [mailto:freeradius-users-bounces+puzzel1982=gmail.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, October 01, 2014 3:43 PM To: FreeRadius users mailing list Subject: Re: Ipad 7.0.4 EAP-TTLS PAP Problem Puzzel wrote:
When i want to connect from ipad with 7.0.3(11B511) version of firmware i can't connect and in logs i have something like that:
Oct 1 13:06:38 radius radiusd[8232]: TLS Alert read:warning:close notify
Oct 1 13:06:38 radius radiusd[8232]: TLS_accept: failed in SSLv3 read client certificate A
Oct 1 13:06:38 radius radiusd[8232]: rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure
That's an OpenSSL issue. FreeRADIUS just uses OpenSSL to do all of the TLS / SSL work. We don't implement SSL ourselves.
Any other systems this certificate work fine.
Check the OpenSSL library versions. The working machine will have a different version than the non-working machine. So... update the non-working machine to the working version of OpenSSL. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Device needed full chain. AddTrust > UserTrust > Terena 2014-10-02 15:27 GMT+02:00 Alan DeKok <aland@deployingradius.com>:
Puzzel wrote:
It looks like ipads (and maybe other apple devices) needs Root and all intermediate certificates.
That's how SSL works. FreeRADIUS should be configured with all of the certificates.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Pozdrawiam Tomasz Karczewski -------------------------------------------------------- Facebook <http://www.facebook.com/puzzelbeats> SoundCloud <http://soundcloud.com/puzzel> YouTube <http://www.youtube.com/user/puzzelmusic>
participants (3)
-
Alan DeKok -
Puzzel -
Tomasz Karczewski