Machine auth fails but user auth works

[Arran Cudbard-Bell]

> On 4 Dec 2015, at 14:23, Dennis Xu <dxu at uoguelph.ca> wrote:
> 
> PEAP does not need to check certificate on client. It is not EAP-TLS. Is there an option to disable the client side certificate validation?
> 
> No we don't have PKI, so not the same CA as AD. It is just a third party trusted CA from Thawte.

You need to bundle as much of the certificate chain as required in the server certificate file, to allow the client to establish the trust relationship from one of its roots to your certificate.

So you need your server cert, and the intermediary CAs all concatenated together in the same file.  Easiest to do this with PEM, as you can just cat >> the base64 armoured certs together.

-Arran

Arran Cudbard-Bell <a.cudbardb at freeradius.org>
FreeRADIUS development team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 872 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20151204/61b67674/attachment.sig>