EAP-TLS Auth. Issues

[SENECAUX Ludovic]

Hi,



I'm having an issue with FreeRADIUS 3.2.3 and the EAP module.

It doesn't take into account my private PKI.

I have to set the reject_unknown_intermediate_ca parameter to no for EAP-TLS authentication to work.

I have no issues with FreeRADIUS 3.0.x

My server is running RHEL 8 and my OpenSSL version is 1.1.1K



Thanks for your help,



Regards,



--



> mods-enabled/eap

eap {

default_eap_type = md5

timer_expire = 60

ignore_unknown_eap_types = no

cisco_accounting_username_bug = no

max_sessions = ${max_requests}

md5 {

}

gtc {

auth_type = PAP

}

tls-config tls-common {

private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem ca_file = ${cadir}/chain.pem ca_path = ${cadir} reject_unknown_intermediate_ca = no cipher_list = "DEFAULT"

cipher_server_preference = no

tls_min_version = "1.2"

tls_max_version = "1.2"

ecdh_curve = ""

cache {

enable = no

store {

Tunnel-Private-Group-Id

}

}

verify {

}

ocsp {

enable = yes

override_cert_url = no

url = "http://127.0.0.1/ocsp/"

}

}

tls {

tls = tls-common

}

ttls {

tls = tls-common

default_eap_type = md5

copy_request_to_tunnel = no

use_tunneled_reply = no

virtual_server = "inner-tunnel"

}

peap {

tls = tls-common

default_eap_type = mschapv2

copy_request_to_tunnel = no

use_tunneled_reply = no

virtual_server = "inner-tunnel"

}

mschapv2 {

}

}



> ls -l certs

total 32

lrwxrwxrwx. 1 root root 17 Jan 23 12:17 3377b39c.0 -> subca.pem lrwxrwxrwx. 1 root root 18 Jan 23 12:17 72f73b82.0 -> rootca.pem -rw-r-----. 1 root radiusd 4111 Jan 23 10:16 chain.pem -rw-r-----. 1 root radiusd 1818 Jan 23 10:17 rootca.pem -rw-r-----. 1 root radiusd 2293 Jan 23 10:17 subca.pem -rw-r-----. 1 root radiusd 1704 Jan 23 10:18 server.key -rw-r-----. 1 root radiusd 8567 Jan 23 10:18 server.pem



> debug (if reject_unknown_intermediate_ca = yes)

[...]

Certificate chain - 1 cert(s) untrusted

(TLS) untrusted certificate with depth [1] subject name /CN=SubCA

(TLS) untrusted certificate with depth [0] subject name /CN=device

tls: There are untrusted certificates in the certificate chain. Rejecting.

(10) eap_tls: (TLS) send TLS 1.2 Alert, fatal internal_error

(10) eap_tls: ERROR: (TLS) Alert write:fatal:internal error

(10) eap_tls: ERROR: (TLS) Server : Error in error

(10) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed

(10) eap_tls: ERROR: (TLS) System call (I/O) error (-1)

(10) eap_tls: ERROR: (TLS) EAP Receive handshake failed during operation

(10) eap_tls: ERROR: [eaptls process] = fail

(10) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed

(10) eap: Sending EAP Failure (code 4) ID 26 length 4

(10) eap: Failed in EAP select

(10) [eap] = invalid

(10) } # authenticate = invalid

(10) Failed to authenticate the user

(10) Using Post-Auth-Type Reject

[...]