blockage in my Freeradius configuration [First SOLVED]self signed certificate in certificate chain [NOK]

[Yves Deuscher]

I change rule and this is solved

My file users
_______________________________________

DEFAULT         Huntgroup-Name == "cisco"
                Service-Type = NAS-Prompt-User,
                Cisco-AVPair = "shell:priv-lvl=15",
                Fall-Through = Yes



DEFAULT         Group == "Central"
DEFAULT         Group == "DEP25", Client-Shortname == "25"
DEFAULT         Group == "DEP29", Client-Shortname == "29"
DEFAULT         Group == "DEP57", Client-Shortname == "57"
DEFAULT         Auth-Type := Reject
______________________________________


For my second problem ,It isn't resolve.
debug :
Error: TLS Alert read:fatal:unknown CA
Sun Feb  2 22:03:14 2014 : Error:     TLS_accept: failed in SSLv3 read
client certificate A
Sun Feb  2 22:03:14 2014 : Error: rlm_eap: SSL error error:14094418:SSL
routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
Sun Feb  2 22:03:14 2014 : Error: SSL: SSL_read failed inside of TLS (-1),
TLS session fails.

and trace user:
 ./eapol_test -c eapol-config -a xen-squeeze-freeradius -p 1812 -s
testing123 -r1

EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request id=4 method=21 vendor=0 vendorMethod=0
EAP: EAP entering state METHOD
SSL: Received packet(len=509) - Flags 0x80
SSL: TLS Message Length: 2527
SSL: (where=0x1001 ret=0x1)
SSL: SSL_connect:SSLv3 read server hello A
TLS: Certificate verification failed, error 19 (self signed certificate in
certificate chain) depth 1 for '/C=FR/ST=Radius/L=Somewhere/O=Example
Inc./emailAddress=admin at example.com/CN=xen-squeeze-freeradius'
CTRL-EVENT-EAP-TLS-CERT-ERROR reason=1 depth=1
subject='/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=
admin at example.com/CN=xen-squeeze-freeradius' err='self signed certificate
in certificate chain'
SSL: (where=0x4008 ret=0x230)
SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA
SSL: (where=0x1002 ret=0xffffffff)
SSL: SSL_connect:error in SSLv3 read server certificate B
OpenSSL: openssl_handshake - SSL_connect error:14090086:SSL
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
SSL: 7 bytes pending from ssl_out
SSL: Failed - tls_out available to report error
SSL: 7 bytes left to be sent out (of total 7 bytes)
EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE

My ca.cnf
...
[ req ]
prompt            = no
distinguished_name    = certificate_authority
default_bits        = 2048
input_password        = whatever
output_password        = whatever
x509_extensions        = v3_ca

[certificate_authority]
countryName        = FR
stateOrProvinceName    = Radius
localityName        = Somewhere
organizationName    = Example Inc.
emailAddress        = admin at example.com
commonName        = "xen-squeeze-freeradius"

[v3_ca]
subjectKeyIdentifier    = hash
authorityKeyIdentifier    = keyid:always,issuer:always
basicConstraints    = CA:true
...

My server.cnf
...
[ req ]
prompt            = no
distinguished_name    = server
default_bits        = 2048
input_password        = whatever
output_password        = whatever

[server]
countryName        = FR
stateOrProvinceName    = Radius
localityName        = Somewhere
organizationName    = Example Inc.
emailAddress        = admin at example.com
commonName        = "xen-squeeze-freeradius"


err='self signed certificate in certificate chain'
I followed the guide
http://deployingradius.com/documents/configuration/certificates.html
but Freeradius error is "self-signed certificate." How to remove this error?
 thank you!!!!



2014-01-31 Alan DeKok <aland at deployingradius.com>:

> Yves Deuscher wrote:
> > For DEP commissioned the first connection goes well
> >
> >
> > Thu Jan 30 23:48:28 2014 : Info: ++[eap] returns noop
> > Thu Jan 30 23:48:28 2014 : Info: ++[unix] returns updated
> > Thu Jan 30 23:48:28 2014 : Info: [files]        expand:
> > %{Client-Shortname} -> DEP25
> > Thu Jan 30 23:48:28 2014 : Info: [files] users: Matched entry DEFAULT at
> > line 208
> > Thu Jan 30 23:48:28 2014 : Info: ++[files] returns ok
>
>   You'll have to look at the rest of the debug log to see what's going on.
>
>   If the packets are being processed differently, it's because the
> packets are different.  You'll have to look at the packets to see what's
> different.  Then, re-write the rules to match both packets.
>
> > I miss something for the dynamic substitution takes place at each
> > connection or I can not be the problem taken in the right direction have?
>
>   Each packet is completely independent.  FreeRADIUS doesn't change it's
> behavior from one packet to the next.
>
> > More I try to configure a secure WPA / TTLS working with all key
> > calculated installing Freeradius. by cons with mine I have a CA_unknown
> > error do you have a clue?
>
>   Follow the EAP guide on http://deployingradius.com/ .   It *will* work.
>
>   If you have unknown CA errors, it's because the certificate
> configuration is wrong.  Follow the guide.
>
>   Alan DeKok.
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20140202/6a1ff880/attachment.html>