Hello: I'm setting up EAP-TLS for the first time using the test certificates. Can someone please look at the debug output and help me find what's causing the failure ? I think I've included the correct snippet: rad_recv: Access-Request packet from host 192.168.10.22 port 49205, id=37, length=128 NAS-IP-Address = 192.168.10.22 NAS-Port-Type = Ethernet NAS-Port = 12 User-Name = "client" State = 0xda0f395eda0d3de3fa5ad84917a2fd9b Called-Station-Id = "EC-1D-8B-EC-5C-F7" Calling-Station-Id = "00-40-8C-BF-28-F4" EAP-Message = 0x02020006030d Message-Authenticator = 0x6ffb217a2a4a97d64cd8714d965b7b2b # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "client", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry client at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 37 to 192.168.10.22 port 49205 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xda0f395edb0c34e3fa5ad84917a2fd9b Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.22 port 49205, id=38, length=128 NAS-IP-Address = 192.168.10.22 NAS-Port-Type = Ethernet NAS-Port = 12 User-Name = "client" State = 0xda0f395edb0c34e3fa5ad84917a2fd9b Called-Station-Id = "EC-1D-8B-EC-5C-F7" Calling-Station-Id = "00-40-8C-BF-28-F4" EAP-Message = 0x020300060300 Message-Authenticator = 0x18eed350fa3d2921bb07065aa89044d8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "client", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry client at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] NAK asked for bad type 0 [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Thank you, Joe