FreeRadius Ceritificate Migration

[John Dennis]

On 05/13/2013 01:46 PM, Mitch Yackobeck wrote:
> Good afternoon All,
>
> I've taken some time over the last couple little while to work with my
> test environment in getting it upto date and trying out some issues with
> regards authenticating against multiple certificates on a single SSID
> for the purpose of migration to a new root certificate while still
> continuing to function with the old in the transition phase.
>
> What I'm finding tho is that when I try to authenticate against that
> particular server, which now has both its own certs applied and the root
> cert from my production server as well to replicate the instance of a
> new root being installed, is that I can authenticate a user with the
> specific certs for the test server, but not a client using certs for the
> production server.
>
> I've taken a few captures of the server coming online using -X, an
> attempted connection with the production certs and also the
> configuration of my eap.conf file.  I can see in initial stages that the
> EAP-TLS actually reads a bit of what the client is passing, enough to
> say that it has a valid client cert.   But when it comes back to dive
> deeper into the cert, it appears that it does not recognize the CA as
> being there and bottoms out the request with a reject.
>
> I've got both roots in a single file in the directory specified and when
> I do an openssl verify on the roots, it does come back :ok.   I found
> some articles on how to link up the new certificate in openssl so that
> it can at least read it properly as trusted.  But the FR server appears
> not to recognize it on the second pass.   Perhaps I'm missing something,
> but is it even possible to authenticate using both root CA's at one time?
>
> Thank you in advance for any assistance / guidance anyone can provide
> with this.

A couple of hints:

Do write comprehensible prose where you state the goal, what you've 
done, and your analysis.

Do not send jpg images!

Do send the output of radiusd -X.

Since you live and work in Ontario I can only assume you're a native 
English speaker. Reread your first paragraph, it's incomprehensible 
gibberish. In order to communicate with others it would behoove you to 
learn sentence and paragraph structure. Do you really work for a school 
system? Sorry, I don't mean to be snarky but I read your email 3 times 
and although I can approximate the problem you're encountering it's so 
lost amid the poor writing I for one am not inclined to help. Writing 
still matters and pictures will never be a substitute.

Would you like to try this again but with something comprehensible and 
which follows the rules of the list (i.e. include the output of radiusd -X).