Problems in EAP-TLS in new Windows XP clients

[Jose Marcos Lopez Caravaca]

 Hi.

 I have been stuck in this problem for a quite a long time, I hope you can help me.

 I have a wireless network using WPA-Enterprise, with EAP-TLS using radius 1.0.2. The system
has been working good so far, using Windows XP clients and Linux with wpasupplicant
with no problems.

 On the last month I'm having problems making new Windows XP clients connect to the network,
even when old instalations of Windows XP SP2 are working good so far. The OEM Windows XP on the
new machines don't interoperate correctly with freeradius, or seems so.

 Then non-working machines get stuck on the autentication phase and seem to loop the requests
all the time.

 I've tried upgrading freeradius from 1.0.2 to 1.1.3, but the problem still persists, "old"
machines connect without any problem but new ones get stuck.

 Both client and server certificate have the OID's refered in the documentation:

 Client:

# /home/soft-local/openssl-0.9.8c/bin/openssl x509 -in /tmp/personal.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 206 (0xce)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ES, ST=Barcelona, L=Barcelona, O=Universitat Politecnica de Catalunya, OU=Departament de Llenguatges i Sistemes Informatics, CN=Laboratori de Calcul de LSI/emailAddress=lclsi at lsi.upc.edu
        Validity
            Not Before: Sep  5 10:15:15 2006 GMT
            Not After : Dec  1 08:00:00 2006
        Subject: C=ES, ST=Barcelona, L=Barcelona, O=UPC, OU=LSI, CN=marcos/emailAddress=marcos at lsi.upc.edu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:d7:f7:ba:f3:d0:69:ca:bf:c9:33:28:71:a6:cd:
                    08:1a:74:3e:e4:f1:e1:ed:00:7e:8c:76:1c:d0:43:
                    7b:1e:32:c0:3f:ad:a5:da:ea:38:96:c9:69:a2:4d:
                    cc:cb:a4:62:24:34:0f:a9:bc:ca:9f:38:d9:84:c3:
                    d9:bd:4d:98:d9:ad:92:82:82:59:2c:0c:64:17:97:
                    00:d4:c4:f3:b1:03:f4:88:05:de:1e:1b:22:ea:47:
                    1c:16:b5:f7:65:0f:17:6f:a9:e1:e4:ce:99:96:e5:
                    eb:40:7c:28:d8:e6:b3:be:71:3e:e0:e9:1a:56:d3:
                    e2:44:f7:3d:28:6e:d3:29:3d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
    Signature Algorithm: md5WithRSAEncryption
        a1:26:ae:7b:43:33:3e:40:87:20:68:24:00:13:e2:37:2c:ae:
        f9:e4:17:1f:11:32:53:b2:14:3e:11:f4:d9:1a:c5:b7:2e:37:
        3b:41:5d:75:13:c7:0d:be:bc:51:97:b8:06:48:07:de:5f:02:
        8f:27:5b:c9:7d:33:bf:84:8c:db:9f:74:3c:2e:42:f6:96:1b:
        6a:c4:47:b7:62:53:8d:22:6f:14:32:9a:67:5e:9d:8f:d8:b4:
        ca:fc:e9:ab:fd:16:4f:c7:f9:91:9b:65:43:e7:b2:35:6a:a2:
        9c:0b:0f:3a:1d:d9:75:ea:3b:4a:68:98:22:de:ba:f2:3e:f7:
        a4:a8

 Server:
# /home/soft-local/openssl-0.9.8c/bin/openssl x509 -in /home/soft-local/freeradius-1.1.3/etc/raddb/certs/cert-srv.pem -noout -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 153 (0x99)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=ES, ST=Barcelona, L=Barcelona, O=Universitat Politecnica de Catalunya, OU=Departament de Llenguatges i Sistemes Informatics, CN=Laboratori de Calcul de LSI/emailAddress=lclsi at lsi.upc.edu
        Validity
            Not Before: Mar 15 11:13:27 2006 GMT
            Not After : Mar 15 11:13:27 2007 GMT
        Subject: C=ES, ST=Barcelona, L=Barcelona, O=Departament de Llenguatges i Sistemes Informatics, OU=Laboratori de Caulcul de LSI, CN=Servei Wireless de LCLSI/emailAddress=lclsi at lsi.upc.edu
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:aa:eb:d5:19:3d:63:4b:ee:b2:ae:c2:73:24:69:
                    cd:61:0a:44:66:45:fe:e9:2e:c0:90:be:1a:c5:39:
                    2a:95:9e:53:ee:0f:29:01:28:43:6e:e6:11:44:09:
                    1c:e7:ae:b8:72:22:9d:03:60:26:6f:90:92:cf:bb:
                    22:66:61:3f:ba:5a:89:62:c0:aa:09:aa:9c:2f:05:
                    b9:67:c1:b2:0e:ad:5e:9d:ab:c4:45:79:51:97:fd:
                    15:da:ba:29:06:5f:fb:4a:d0:7d:80:2e:7d:b9:91:
                    58:32:56:a8:69:36:7e:9c:54:66:ac:25:10:62:be:
                    e1:60:f0:aa:9b:02:fc:b6:8b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication
    Signature Algorithm: md5WithRSAEncryption
        bb:b0:de:06:6a:03:fd:34:f7:38:8d:07:e7:b7:ee:97:0a:94:
        f2:82:ab:10:6b:08:cf:4c:9f:97:e7:be:a3:1b:12:e5:9a:b1:
        86:35:85:20:06:4a:a9:51:f3:83:de:69:6e:e5:c4:22:e5:88:
        17:f4:23:e7:70:5b:f6:d2:ae:50:c5:e6:c4:fd:93:f4:b8:61:
        92:df:1d:9d:01:1b:16:87:02:6c:a5:02:87:7b:ad:bc:a3:65:
        26:7c:82:81:48:e9:62:60:ab:c5:63:fc:9f:17:d0:d9:7f:53:
        3d:e7:bc:85:f9:01:a9:97:e7:88:2a:d9:b2:a2:8a:7c:1c:bd:
        85:4a

 And the traces of the server:

 - Working on an "old" machine attached as http://www.lsi.upc.edu/~marcos/correcto.txt
 - Non-Working on a "new" machine attached as http://www.lsi.upc.edu/~marcos/incorrecto.txt

 Thank you all.