unsupported certificate purpose
murugesh pitchaiah
murugesh.pitchaiah at gmail.com
Fri Oct 30 18:47:52 CET 2020
Thanks Alan B and Alan K.
I generated key and certificate using the openssl.cnf and below steps:
openssl genrsa -aes256 -out key.pem
openssl req -config openssl.cnf -key key.pem new -sha256 -out csr.pem
openssl ca -config openssl.cnf -extensions usr_cert -days 375 -notext
-md sha256 -in csr.pem -out cert.pem
This generation is done in a linux box with openssl 1.0.2.
While verifying with openssl 1.1.0 (also using 1.0.2) using below
steps - in the ubuntu where freeradius is running - it shows OK.
openssl verify -CAfile cacert.pem cert.pem
cert.pem: OK
But only freeradius is throwing the error on purpose.
Still i generated a new client certificate without the 'digital
signature' key usage.
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
DD:4A:55:26:9E:7F:27:E9:F6:14:63:CE:95:A3:AD:78:68:7F:56:A6
X509v3 Authority Key Identifier:
keyid:44:C9:8D:CB:50:17:D2:33:60:4F:96:1A:76:34:99:A4:0D:FA:A1:8D
X509v3 Extended Key Usage:
TLS Web Client Authentication
But result is same.
0) TLS_accept: SSLv3/TLS write server done
(0) <<< recv TLS 1.2 [length 07ac]
(0) Creating attributes from certificate OIDs
(0) ERROR: SSL says error 26 : unsupported certificate purpose
(0) >>> send TLS 1.2 [length 0002]
(0) ERROR: TLS Alert write:fatal:unsupported certificate
tls: TLS_accept: Error in error
(0) ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL
routines:tls_process_client_certificate:certificate verify failed
(0) ERROR: System call (I/O) error (-1)
(0) FAILED in TLS handshake receive
Closing TLS socket from client port 57851
Should I generate again with openssl 1.1.0 ? But I wonder how the
"openssl verify" works good with openssl 1.1.0; but not freeradius's
SSL Read.
Thanks in advance.
Thanks
murugesh
On 10/30/20, Alan DeKok <aland at deployingradius.com> wrote:
> On Oct 30, 2020, at 8:21 AM, murugesh pitchaiah
> <murugesh.pitchaiah at gmail.com> wrote:
>> while trying for radsec I see freeradius throwing below error on TLS
>> handshake:
>>
>> (0) TLS_accept: SSLv3/TLS write server done
>> (0) <<< recv TLS 1.2 [length 07b9]
>> (0) Creating attributes from certificate OIDs
>> (0) ERROR: SSL says error 26 : unsupported certificate purpose
>
> That seems relatively clear.
>
>> (0) >>> send TLS 1.2 [length 0002]
>> (0) ERROR: TLS Alert write:fatal:unsupported certificate
>> tls: TLS_accept: Error in error
>> (0) ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL
>> routines:tls_process_client_certificate:certificate verify failed
>
> So it's the client certificate which is failing here. That's at least
> better than some of the other OpenSSL error messages. :(
>
>> Here is the client certificate's purpose details:
>>
>> X509v3 extensions:
>> X509v3 Basic Constraints:
>> CA:FALSE
>> X509v3 Key Usage:
>> Digital Signature
>
> Is the client certificate signing other certificates? I suspect not...
>
>> Netscape Comment:
>> OpenSSL Generated Certificate
>> X509v3 Subject Key Identifier:
>> AE:C8:80:61:1C:AB:99:03:8F:13:4F:14:95:EA:61:52:4D:8C:37:E8
>> X509v3 Authority Key Identifier:
>>
>> keyid:44:C9:8D:CB:50:17:D2:33:60:4F:96:1A:76:34:99:A4:0D:FA:A1:8D
>>
>> X509v3 Extended Key Usage:
>> TLS Web Client Authentication
>
> That should work.
>
>> I see the key usage and Extended usage look good; still unable to find
>> whats reason for freeradius rejecting the client certificate
>
> It's not. :( OpenSSL is rejecting the client certificate.
>
>> client openssl ; 1.0.2
>> freeradius: 3.0.16 and i see this has openssl 1.1.0
>
> How did you generate the certificates?
>
> If you copy the client certificate to the OpenSSL machine, you can verify
> it there using the "openssl" command-line too.
>
> What's likely happening is that OpenSSL 1.1.0 is doing more stringent
> checks than OpenSSL 1.0.2. So you'll need to regenerate the certificate,
> without the offending OIDs.
>
> Alan DeKok.
>
>
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
More information about the Freeradius-Users
mailing list