EAP-PEAP - difference between 3.0.25 and 3.2
zarychtam at plan-b.pwste.edu.pl
Tue Jun 28 13:41:51 UTC 2022
W dniu 28.06.2022 o 15:04, Kamil Jońca pisze:
> Matthew Newton <mcn at freeradius.org> writes:
>> On 28/06/2022 08:41, Kamil Jońca wrote:
>>> Debian box with debian radius packages.
>>> There is old phone (Samsung Wave) which was configured to use PEAP0
>>> connect to wifi.
>> If it's an old phone you might want to check OpenSSL ciphers / TLS
>> versions. That's the most likely.
> I have some older devices and I have to enable some strange ciphers :(
>>> Of course I can provide logs, but they are quite huge.
>> Please send logs of both. We don't have time to make random guesses.
>> Just from `freeradius -X` (not -xxx, -Xx, etc)
From provided logs, it looks like not the client, but the server
insists on degrading TLS to v1.0 in the handshake. Maybe trying with the
wider range of acceptable TLS versions in eap module could solve the issue:
tls_min_version = "1.0"
tls_max_version = "1.3"
FreeRadius 3.2.0 works perfectly for this range for eap-ttls performing
tunnelled authentications and servicing clients capable of TLSv1.0,
TLSv1.2 and TLSv1.3 methods.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 495 bytes
Desc: OpenPGP digital signature
More information about the Freeradius-Users