PEAP fatal bad_certificate

[Ruslan N. Marchenko]

It seems to be not a particular question, but...

client - winxp wireless, ap - AIR-AP1131AG-E-K9, server 
1.1.6. fresh install.
certificates generated according to CA.all (with 
xp-extension and conversion to pkcs12)

  eap {
    default_eap_type = peap
    timer_expire     = 60
    ignore_unknown_eap_types = no
    cisco_accounting_username_bug = no

    md5 {
    }

    leap {
    }

    gtc {
     auth_type = PAP
    }

    tls {
     private_key_password = xxxxx
     private_key_file = ${raddbdir}/certs/merlin-crt.pem
     certificate_file = ${raddbdir}/certs/merlin-crt.pem
     CA_file = ${raddbdir}/certs/cacert.pem

     dh_key_length = 1024
     dh_file = ${raddbdir}/certs/dh
     random_file = /dev/urandom
    }
    peap {
     default_eap_type = mschapv2
    }
    mschapv2 {
    }
  }

   Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 224
   rlm_eap: Request found, released from the list
   rlm_eap: EAP/peap
   rlm_eap: processing type peap
   rlm_eap_peap: Authenticate
   rlm_eap_tls: processing TLS
   eaptls_verify returned 7
   rlm_eap_tls: Done initial handshake
   rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal 
bad_certificate
TLS Alert read:fatal:bad certificate
     TLS_accept:failed in SSLv3 read client certificate A
rlm_eap: SSL error error:14094412:SSL 
routines:SSL3_READ_BYTES:sslv3 alert bad certificate
rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS 
session fails.
   eaptls_process returned 13
   rlm_eap_peap: EAPTLS_HANDLED
   rlm_eap: Freeing handler
   modcall[authenticate]: module "eap" returns reject for 
request 224
modcall: leaving group authenticate (returns reject) for 
request 224
auth: Failed to validate the user.



--
Olimp, System Administrator IT Dept.
Fax. +380(62)381-3428
Tel. +380(62)381-3978-5
----
Looking forward to reading yours.
  RUFF-RIPE DI76-GANDI RUFF-6BONE
      Ruslan N. Marchenko