Quoting Michael Griego <[EMAIL PROTECTED]>: > I'm guessing you're using the Windows XP supplicant? This looks like a > classic case of your CA certificate not being present on the client machine. > > --Mike > > ----------------------------------- > Michael Griego > Wireless LAN Project Manager > The University of Texas at Dallas
Hi. Yes, I uses WinXP(sp2) supplicant and access point is Intel 2011B. I create new certicates. Then I copy root.der and client-crt.p12 files to supplicant. Windows shows that certificates are ok and using to remote client identity. (I trying tls method too). Now, in authentication process, I found following error line. rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 03a8], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0044], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 Next lines tells how I create certificates. ****Server certificate******* openssl genrsa -des3 -out server-key.pem 2048 openssl req -new -key server-key.pem -out server-csr.pem openssl req -in server-csr.pem -out server-crt.pem -key server-key.pem -x509 -days 3652 openssl ca -in server-csr.pem -out server-crt.pem -days 3652 -policy policy_anything ****root certificate****** cp server-crt.pem root.pem openssl x509 -in root -inform PEM -out root.der -outform DER ****client certificate****** openssl genrsa -des3 -out client-key.pem 2048 openssl req -new -key client-key.pem -out client-csr.pem openssl ca -in client-csr.pem -out client-crt.pem -days 125 -extensions xpclient_ext -extfile xpextensions -policy policy_anything openssl pkcs12 -export -in client-crt.pem -inkey client-key.pem -name "Radius Suse" -certfile client-crt.pem -out client.p12 openssl x509 -inform PEM -outform DER -in client-clt.pem -out client-clt.der - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html