Multiple EAP-TLS modules with different certificates

[Thibault Le Meur]

Hi,

I'm about to change the CA of my radius server certificate. At the same 
time I've installed a new wifi network and plan to change the SSID as 
well (authentication is EAP-TTLS or EAP-PEAP).

In order to avoid a complete breakout when I change the certificate of 
my radius server (because a manual operation is required on the 
supplicant side to select the new CA), I'd like to configure FR so that:
* when the WiFi client connects to the SSID1, the server uses the old 
certificate and key,
* and when the client uses the SSID2, the radius server uses the new 
certificate and key

Is this possible ?

I've already tried such a configuration by:
* defining 2 eap modules let's say "eapOld" and "eapNew" (each with its 
own key and cert)
* making sure that depending on the SSID, the access-point sets a 
different NAS-Identifier (let's say ID1 and ID2) in the Access-request
* in the virtual FR server, I've used unlang to run either eap module:
   in authorize:
                       if ("%{request:NAS-Identifier}" == ID1) {
                               eapOld {
                                   ok = return
                       }

                       if ("%{request:NAS-Identifier}" == ID2) {
                               eapNew {
                                   ok = return
                       }
 in authenticate:
        Auth-Type eapNew {
                eapNew
        }
        Auth-Type eapOld {
                eapOld
        }
in eap.conf: the two eap modules only differ from their certificate/key, 
they redirect to the same inner-tunnel virtual server.

The result so far is that with such setup my wireless clients can't 
connect at all when they check the certificate, but can connect when 
they don't (no matter what setup is done on the client side). Of course 
I've installed the 2 certificates on the client to check this.

A quick look at FR debug logs confirms, as far as I can read them, that 
the client is refusing the radius server certificate.

Is there a client tool to check which certificate is used by FR ?
Have I missed something in the setup ?

I've tried to turn on Windows EAP log, but they aren't very easy to read 
as far as TLS/TTLS/PEAP authentication is concerned !

Environement: FR is 2.1.1, client used Windows XP SP3 and Windows 7.

Thanks a lot for your ideas, proposals, ...

Best regards,
Thibault