Re: Problem with EAP-TLS and certificate

2012-06-18 Thread Matthew Newton
On Sun, Jun 17, 2012 at 11:07:31PM -0400, Stephane Brodeur wrote: > My problem is the following error message when running eapol_test > > TLS: Trusted root certificate(s) loaded > OpenSSL: SSL_use_certificate_file (DER) --> OK > OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (DER) f

Re: Problem with EAP-TLS and certificate

2012-06-17 Thread Alan DeKok
Stephane Brodeur wrote: > I am a newbie to Freeradius and I am having a real hard time to > implement EAP-TLS using self-signed certificate. Why? The server comes with scripts that create self-signed certs. See raddb/certs. If you search google for "freeradius eap-tls howto", the first link is

Problem with EAP-TLS and certificate

2012-06-17 Thread Stephane Brodeur
Hi, I am a newbie to Freeradius and I am having a real hard time to implement EAP-TLS using self-signed certificate. My certificate seems valid: Server Certificate [root@localhost CA]# openssl verify -CAfile /etc/pki/CA/cacert.pem xplab.pem xplab.pem: OK Client certificate [root@localhost CA]

Problem with EAP-TLS.

2011-05-11 Thread Miguel Miralles
Hi, i'm implementing authentication for 802.1X using Freeradius (version 2.1.6 ) in Fedora10. The supplicant is windows XP wiht Service pack 3. The NAS is Switch cisco and the network is wire. My problem is what the connection works good when the autentication is for user and password, but if chang

Problem with EAP-TLS authentication in Freeradius

2011-04-25 Thread senthil kumar
Hi All, I am using Freeradius 2.1.0 PEAP/TTLS is working fine and I am facing problem in TLS authentication. I am able to generate certificate but while connecting it throws Authentication error. Can some one send me client.cnf and server.cnf. Also let me know whether installing o

Re: Problem with EAP-TLS authentication in Freeradius 2.1.0

2011-04-13 Thread senthil kumar
Hi, Can anyone please give some solution or idea to debug it. Regards Senthil On Mon, Apr 11, 2011 at 5:57 PM, senthil kumar wrote: > Hi Alan, > Any solution or debug to this problem. > Please let me know. > > > > Regards > Senthil > > > > On Fri, Apr 8, 2011 at 1:43 PM, s

Re: Problem with EAP-TLS authentication in Freeradius 2.1.0

2011-04-11 Thread senthil kumar
Hi Alan, Any solution or debug to this problem. Please let me know. Regards Senthil On Fri, Apr 8, 2011 at 1:43 PM, senthil kumar wrote: > Hi Alan, > Earlier I have faced the same problem and after changing Make file it > was working fine. >Now certificate got expire

Re: Problem with EAP-TLS authentication in Freeradius 2.1.0

2011-04-08 Thread senthil kumar
Hi Alan, Earlier I have faced the same problem and after changing Make file it was working fine. Now certificate got expired and I tried to generate new certificate. Problem is I am not able to connect with the new certificate. So please let me know how to solve this problem. Regard

Re: Problem with EAP-TLS authentication in Freeradius 2.1.0

2011-04-08 Thread Alan DeKok
senthil kumar wrote: > I am using Freeradius 2.1.0 > PEAP/TTLS is working fine and I am facing problem in TLS > authentication. I am able to generate certificate but while connecting > it throws Authentication error. > Please let me know how to debug it. *Read* the debug log. T

Problem with EAP-TLS authentication in Freeradius 2.1.0

2011-04-08 Thread senthil kumar
Hi All, I am using Freeradius 2.1.0 PEAP/TTLS is working fine and I am facing problem in TLS authentication. I am able to generate certificate but while connecting it throws Authentication error. Please let me know how to debug it. rad_recv: Access-Request packet from host 1

Problem with EAP-TLS authentication in Freeradius 2.1.0

2011-04-07 Thread senthil kumar
Hi All, I am using Freeradius 2.1.0 PEAP/TTLS is working fine and I am facing problem in TLS authentication. I am able to generate certificate but while connecting it throws Authentication error. Please let me know how to debug it. rad_recv: Access-Request packet from host 19

Re: Problem with EAP TLS authentication in Freeradius

2009-12-16 Thread tnt
> I have copied MAKE file from the 2.1.8 pre version.But not able to > generate > certificates. > When I try to run ./bootstrap , it throws error related to MAKE.in file > > Please let me know the procedure to generate a certificate. Read the README file in certs directory. Ivan Kalik - List inf

Re: Problem with EAP TLS authentication in Freeradius

2009-12-16 Thread senthil kumar
Hi I have copied MAKE file from the 2.1.8 pre version.But not able to generate certificates. When I try to run ./bootstrap , it throws error related to MAKE.in file Please let me know the procedure to generate a certificate. Regards Senthil On Wed, Dec 9, 2009 at 1:00 AM, wrote: > > Actually

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08 Thread tnt
> Actually I copied the file from /usr/share/doc/freeradius/examples/certs > folder > But I didnt change any in MAKE file >From which version? 2.1.7 or 2.1.8? 2.1.8 has the new Makefile which signs client certificates with ca certificate. > Is there anyother way to debug it??? That's openSSL stu

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08 Thread tnt
> Where I could get the "makefile" v.2.1.8-pre > Probably it also solves the problem that I have. PS. I would take the whole certs directory. Ivan Kalik - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08 Thread tnt
> Where I could get the "makefile" v.2.1.8-pre > Probably it also solves the problem that I have. Get the whole thing and take what you want: http://git.freeradius.org/pre/ Ivan Kalik - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08 Thread senthil kumar
Actually I copied the file from /usr/share/doc/freeradius/examples/certs folder But I didnt change any in MAKE file Is there anyother way to debug it??? On Tue, Dec 8, 2009 at 3:40 AM, wrote: > > Below is the complete Log.. > > Please let me know how to solve/debug it.. > > > >

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08 Thread Alan DeKok
Fernando Calvelo Vazquez wrote: > Where I could get the "makefile" v.2.1.8-pre > Probably it also solves the problem that I have. http://git.freeradius.org/pre/ Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP TLS authentication in Freeradius

2009-12-08 Thread Fernando Calvelo Vazquez
Where I could get the "makefile" v.2.1.8-pre Probably it also solves the problem that I have. regards, Fernando. t...@kalik.net wrote: Below is the complete Log.. Please let me know how to solve/debug it.. [tls] Done initial handshake [tls] <<< TLS 1.0 Alert [length 0002],

Re: Problem with EAP TLS authentication in Freeradius

2009-12-07 Thread tnt
> Below is the complete Log.. > Please let me know how to solve/debug it.. > > > [tls] Done initial handshake > > [tls] <<< TLS 1.0 Alert [length 0002], warning bad_certificate > > TLS Alert read:warning:bad certificate > It's adifferent error. Quite clear what is wrong. Did you try to

Re: Problem with EAP TLS authentication in Freeradius

2009-12-07 Thread senthil kumar
Hi All, Below is the complete Log.. Please let me know how to solve/debug it.. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 4991, id=2, length=144 User-Name = "maemo" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-

Re: Problem with EAP-TLS, please give me a hint

2009-12-06 Thread tnt
>>> I changed it but it's always the same problem: >>> >>> [tls] TLS_accept: SSLv3 write certificate request A >>> [tls] TLS_accept: SSLv3 flush data >>> [tls] TLS_accept: Need to read more data: SSLv3 read client >>> certificate >>> A >>> >> >> Problem? What problem? Those are normal o

Re: Problem with EAP-TLS, please give me a hint

2009-12-05 Thread _Stefan_H
at the debug in my first post -- View this message in context: http://old.nabble.com/Problem-with-EAP-TLS%2C-please-give-me-a-hint-tp26515010p26657172.html Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with EAP-TLS, please give me a hint

2009-12-05 Thread tnt
> I changed it but it's always the same problem: > > [tls] TLS_accept: SSLv3 write certificate request A > [tls] TLS_accept: SSLv3 flush data > [tls] TLS_accept: Need to read more data: SSLv3 read client > certificate > A > Problem? What problem? Those are normal openSSL messages. Iva

Re: Problem with EAP-TLS, please give me a hint

2009-12-05 Thread _Stefan_H
[tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A Next week I will try it with the other switch and client again. Now I am waiting for an other xp version for my client. -- View this message in

Re: Problem with EAP TLS authentication in Freeradius

2009-12-05 Thread tnt
>Iam using Freeeadius 2.1.0. The setup is working fine with EAP-TTLS, > PEAP > method.But for EAP TLS, it gives the below error.. > Please let me know how to solve.. > > > > [eap] Handler failed in EAP/tls > [eap] Failed in EAP select > ++[eap] returns invalid > Failed to authenticate the user.

Problem with EAP TLS authentication in Freeradius

2009-12-04 Thread senthil kumar
Hi, Iam using Freeeadius 2.1.0. The setup is working fine with EAP-TTLS, PEAP method.But for EAP TLS, it gives the below error.. Please let me know how to solve.. [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Regards S

Re: Problem with EAP-TLS, please give me a hint

2009-12-04 Thread tnt
> Well after i read your post i tried to sign the client certificates with > the > ca. I make some changes in the makefile but it think I made something > wrong > because it doesn't work: > > > > old: > > client.csr client.key: client.cnf > openssl req -new -out client.csr -keyout client.key

Re: Problem with EAP-TLS, please give me a hint

2009-12-03 Thread Fernando Calvelo Vazquez
Great!! Finally, after several weeks posting question on this forum trying to solve "my first test with EAP-TLS", you give with this tip the correct solution!! Thanks a lot Ivan!! Cheers, Fernando. PS: Only for your knowledge... It seems this tip is also applicable to M.Vista (my case ;-)

Re: Problem with EAP-TLS, please give me a hint

2009-12-02 Thread tnt
> > Well, can anyone tell me, why nobody is helping me? I would not get on > your > nerves if there would be a solution to my problem. I was searching for a > time and i found this helpful solutions "look in the FAQ" and "look in > the > eap.conf". > Well the FAQ tells about the xptensions and th

Re: Problem with EAP-TLS, please give me a hint

2009-12-02 Thread Alan DeKok
_Stefan_H wrote: > Well, can anyone tell me, why nobody is helping me? I would not get on your > nerves if there would be a solution to my problem. I was searching for a > time and i found this helpful solutions "look in the FAQ" and "look in the > eap.conf". > Well the FAQ tells about the xptens

Re: Problem with EAP-TLS, please give me a hint

2009-12-02 Thread _Stefan_H
and the help in the eap.conf doesn't give me a solution. I know that you don't like to waste you time on a newbie like me, but please give me only a hint where the problem could be. -- View this message in context: http://old.nabble.com/Problem-with-EAP-TLS%2C-please-give-me-a-hint

Problem with EAP-TLS

2009-11-25 Thread _Stefan_H
Waking up in 0.2 seconds. Cleaning up request 1 ID 4 with timestamp +66 Ready to process requests. Well I use the standardcertificate only for testing, but am I right that the p

Re: problem with eap-tls between FR and XP client

2009-05-07 Thread Alan DeKok
bLn wrote: > I'm trying to connect a Windows XP client (also I'm trying with Vista) > with freeradius with EAP-TLS. I made my set of certificates (from this > site http://www.linuxjournal.com/node/8095/print) Why? If you just start the server in debugging mode after you first install it, it wil

problem with eap-tls between FR and XP client

2009-05-06 Thread bLn
hi forum, I'm trying to connect a Windows XP client (also I'm trying with Vista) with freeradius with EAP-TLS. I made my set of certificates (from this site http://www.linuxjournal.com/node/8095/print) and now, I have: CA, radius_cert.pem, radius_key.pem, radius_keycert.pemradius_req.pem,

Re: Problem with EAP-TLS

2008-10-06 Thread Guk Victor
Message: 2 Date: Wed, 01 Oct 2008 12:34:08 +0100 From: <[EMAIL PROTECTED]> Subject: Re: Problem with EAP-TLS To: "FreeRadius users mailing list" Message-ID: <[EMAIL PROTECTED]> Content-Type: text/plain; charset=ISO-8859-2 Radius is working fine. Yo

Re: Problem with EAP-TLS

2008-10-01 Thread Lech Karol Pawłaszek
Guk Victor wrote: > Hi all. > > I have problem with EAP-TLS. Computer with OS Windows Vista, Freeradius > 1.1.3. > Immediately access to the network exists after connection, but access is > forbidden through several minutes. > This is what it is obtained: Well. I had very s

Re: Problem with EAP-TLS

2008-10-01 Thread tnt
Radius is working fine. Your problem is with NAS: .. >rad_recv: Accounting-Request packet from host 10.0.1.2:5007, id=61, >length=271 .. >Acct-Status-Type = Stop .. >Acct-Session-Time = 120 .. >Acct-Terminate-Cause = Lost-Carrier .. Connection breaks after two minutes. Deb

Problem with EAP-TLS

2008-10-01 Thread Guk Victor
Hi all. I have problem with EAP-TLS. Computer with OS Windows Vista, Freeradius 1.1.3. Immediately access to the network exists after connection, but access is forbidden through several minutes. This is what it is obtained: [EMAIL PROTECTED] ~]# radiusd -X Starting - reading configuration

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)

2008-08-22 Thread Alan DeKok
Andrew Hood wrote: > That's what Sergio seemed to be getting at in changing with the Makefile > to have a CA rather than the server sign the client cert. Is that the > better way? It's a different way. The question you want to ask is if the *CA* issues client certificates, or if the *server* do

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)

2008-08-22 Thread Sergio
Andrew Hood escribió: Alan DeKok wrote: Andrew Hood wrote: Pardon me if I've missed something, but as far as I can tell the server cert isn't authorised to sign client certs, so I can't see how it could work. The CA can sign client certs. There can be multiple levels of CA's.

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)

2008-08-22 Thread Andrew Hood
Alan DeKok wrote: > Andrew Hood wrote: > >>Pardon me if I've missed something, but as far as I can tell the server >>cert isn't authorised to sign client certs, so I can't see how it could >>work. The CA can sign client certs. > > > There can be multiple levels of CA's. Verisign, your company

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)

2008-08-21 Thread Alan DeKok
Andrew Hood wrote: > Pardon me if I've missed something, but as far as I can tell the server > cert isn't authorised to sign client certs, so I can't see how it could > work. The CA can sign client certs. There can be multiple levels of CA's. Verisign, your company, the local division, etc. Th

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)

2008-08-21 Thread Andrew Hood
Alan DeKok wrote: > William Hegardt wrote: > >>EAP-TLS authentication fails with the "fatal unknown ca" message. > > > The server cert may need to be marked with "CA:true" > > >>If I hack the Makefile like Sergio mentioned last month to sign the >>client certificate with >>the CA key, then a

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)

2008-08-19 Thread Alan DeKok
William Hegardt wrote: > EAP-TLS authentication fails with the "fatal unknown ca" message. The server cert may need to be marked with "CA:true" > If I hack the Makefile like Sergio mentioned last month to sign the > client certificate with > the CA key, then authentication succeeds. That can

Re: cert bootstrap bug? (was Re: definitely, I have a problem with eap-tls)

2008-08-19 Thread William Hegardt
I hate to resurrect this long thread from July 22-28, but I have the same problem and never saw a resolution. I'm using FreeRadius 2.0.5 on CentOS 5.2 with wpa_supplicant 0.6.4 (latest to date). I'm using the bootstrap script to generate example certificates. I also created a client certificate u

Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-27 Thread Alan DeKok
Reveal MAP wrote: > now we know what not to do at all. we are still wondering what we have > to do. Use a client that isn't broken. Sorry. Try SecureW2. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-27 Thread Reveal MAP
figure rhe problem out . - Message d'origine De : Alan DeKok <[EMAIL PROTECTED]> À : FreeRadius users mailing list Envoyé le : Dimanche, 27 Juillet 2008, 19h42mn 23s Objet : Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Reveal MAP wrote: > Y

Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-27 Thread Alan DeKok
Reveal MAP wrote: > Yes, Alan, we already now that thedefault config do works! my mind: > freeradius (in our case, sergio and me) is correctly configured. But, we > encounterd a problem showing no error message. so to make the log > slimmer, why not deactivate some non mandatory module in our scena

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-27 Thread Reveal MAP
d the certificatuion chain!!! thanx a lot - Message d'origine De : Alan DeKok <[EMAIL PROTECTED]> À : FreeRadius users mailing list Envoyé le : Dimanche, 27 Juillet 2008, 8h51mn 35s Objet : Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Ser

Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-27 Thread Reveal MAP
I'm agree, a good begining would be comment out all modules you're not using. The instances of the modules are in sites-enabled/default and sites-enabled/inner-tunnel (for peap and ttls). - --- Donb't worry, it will be done soon (as soon as the week starts again ). i really want to figure it

Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-27 Thread Alan DeKok
Sergio wrote: > I'm agree, a good begining would be comment out all modules you're not > using. The instances of the modules are in sites-enabled/default and > sites-enabled/inner-tunnel (for peap and ttls). For debugging... no. The default configuration file WORKS in the widest possible set of

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-27 Thread Sergio
Anders Holm escribió: [snip] rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. //Normal, i am not willing to do PAP but mschapv2 If you’re not using a module, disable it. All it’ll do is add latency, delays and unne

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-26 Thread Reveal MAP
e: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) > http://tinypaste.com/5b99b = Radiusd -X output. [snip] rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this.//Normal, i am n

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-26 Thread Reveal MAP
hmm... it's true i didn't test authentication with another laptop! i will! and i will too with secureW2 instead ofXP built-in wireless manager, and see!! > see the logf there: http://tinypaste.com/5b99b Your problem is nothing to do with certificates. The PEAP tunnel gets setup correctly, the

Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-26 Thread Anders Holm
> [snip] > > rlm_pap: WARNING! No "known good" password found for the user. Authentication > may fail because of this.//Normal, i am not willing to do > PAP but mschapv2 > > If you¹re not using a module, disable it. All it¹ll do is add latency, > delays and unnecessary log m

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-26 Thread Reveal MAP
De : nf-vale <[EMAIL PROTECTED]> À : FreeRadius users mailing list Envoyé le : Vendredi, 25 Juillet 2008, 20h51mn 58s Objet : Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Are you using vista supplicant? By reading the last lines of your radius debug

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-26 Thread Reveal MAP
thanx for responding dude. let's take a look at this part of log! (remember too that i am a new linux, many thing are still chinese for me) i agree, my certificate are OK to do EAP in general my coments are the red lines : my mschap module config is: -- mschap { use_mppe = yes

Re: Re : Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-26 Thread Phil Mayers
see the logf there: http://tinypaste.com/5b99b Your problem is nothing to do with certificates. The PEAP tunnel gets setup correctly, the MS-CHAP client->server auth succeeds, but the final server->client (mutual) auth appears to fail. This could be for a number of reasons, but it's a probl

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-26 Thread Sergio
Reveal MAP escribió: > installing ca.der and putting user && pass into client machine, the authentication doesn't work? -- no, it doesn't! > you only need ca.der but, if you have an active directory like LDAP, check if your comunication with AD server also have tls authentication. Into ldap

Re: Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-25 Thread Sergio
nf-vale escribió: Are you using vista supplicant? By reading the last lines of your radius debug file it seems so... See earlier posts with subject: "PEAP or TTLS and Microsoft Vista". Sex, 2008-07-25 às 17:10 +, Reveal MAP escreveu: installing ca.der and putting user && pass in

Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-25 Thread nf-vale
Are you using vista supplicant? By reading the last lines of your radius debug file it seems so... See earlier posts with subject: "PEAP or TTLS and Microsoft Vista". Sex, 2008-07-25 às 17:10 +, Reveal MAP escreveu: > > > > installing ca.der and putting user && pass into client machine,

Re : Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-25 Thread Reveal MAP
> installing ca.der and putting user && pass into client machine, the authentication doesn't work? -- no, it doesn't! > you only need ca.der but, if you have an active directory like LDAP, check if your comunication with AD server also have tls authentication. Into ldap module you can conf

Re: Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-25 Thread Sergio
xp. if you have a suggestion, i am open! - Message d'origine De : Sergio <[EMAIL PROTECTED]> À : FreeRadius users mailing list Envoyé le : Vendredi, 25 Juillet 2008, 13h20mn 54s Objet : Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Revea

Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-25 Thread Reveal MAP
on, i am open! - Message d'origine De : Sergio <[EMAIL PROTECTED]> À : FreeRadius users mailing list Envoyé le : Vendredi, 25 Juillet 2008, 13h20mn 54s Objet : Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Reveal MAP escribió: > H

Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-25 Thread Sergio
MAIL PROTECTED]> À : FreeRadius users mailing list Envoyé le : Jeudi, 24 Juillet 2008, 19h54mn 32s Objet : Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Sergio wrote: > But the debug I posted shows that radius doesn't recognize the issuer of > client cert

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-25 Thread Reveal MAP
eRadius users mailing list Envoyé le : Jeudi, 24 Juillet 2008, 19h54mn 32s Objet : Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Sergio wrote: > But the debug I posted shows that radius doesn't recognize the issuer of > client cert using default certs. If

Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-25 Thread Phil Mayers
On Thu, Jul 24, 2008 at 09:14:54PM +0200, Alan DeKok wrote: Phil Mayers wrote: Alan - it does look to my untrained eye as if the "client.crt" Makefile target in /etc/raddb/certs is signing the client key with the server key. Is this intentional, or a bug? It's intentional. It's a perfectly v

Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-24 Thread Sergio
Alan DeKok escribió: Sergio wrote: But the debug I posted shows that radius doesn't recognize the issuer of client cert using default certs. If default certs works and I don't need to install server.pem and ca.pem into ssl/certs dir, what I'm forgetting alan? You need to follow the d

Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-24 Thread Alan DeKok
Sergio wrote: > But the debug I posted shows that radius doesn't recognize the issuer of > client cert using default certs. If default certs works and I don't need > to install server.pem and ca.pem into ssl/certs dir, what I'm forgetting > alan? You need to follow the documentation in eap.conf.

Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-24 Thread Sergio
Alan DeKok escribió: Phil Mayers wrote: Alan - it does look to my untrained eye as if the "client.crt" Makefile target in /etc/raddb/certs is signing the client key with the server key. Is this intentional, or a bug? It's intentional. It's a perfectly valid use of certificate chains

Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-24 Thread Sergio
Alan DeKok escribió: Phil Mayers wrote: Alan - it does look to my untrained eye as if the "client.crt" Makefile target in /etc/raddb/certs is signing the client key with the server key. Is this intentional, or a bug? It's intentional. It's a perfectly valid use of certificate chains

Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-24 Thread Alan DeKok
Phil Mayers wrote: > Alan - it does look to my untrained eye as if the "client.crt" Makefile > target in /etc/raddb/certs is signing the client key with the server > key. Is this intentional, or a bug? It's intentional. It's a perfectly valid use of certificate chains. The idea is that you h

cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)

2008-07-24 Thread Phil Mayers
Yeah!! Then you're agree with me. I've been explaining (trying) in this forum that client cert must be signed by ca cert. bootstrap command sign client cert with server.key and this not works. The solution is to replace de signing in certs/Makefile (-key server.key -cert server.pem should be

Re: definitively, I have a problem with eap-tls

2008-07-24 Thread Sergio
Phil Mayers escribió: ok :) I provide certificate files and eap.conf in a tar ball to not to post a mail too long. If I print [EMAIL PROTECTED] in text form I see how radius is the issuer of the certificate. This is the default PKI and I don't know what I'm doing wrong. Thanks for your atten

Re: definitively, I have a problem with eap-tls

2008-07-24 Thread Phil Mayers
ok :) I provide certificate files and eap.conf in a tar ball to not to post a mail too long. If I print [EMAIL PROTECTED] in text form I see how radius is the issuer of the certificate. This is the default PKI and I don't know what I'm doing wrong. Thanks for your attention. I get the exact

Re: definitively, I have a problem with eap-tls

2008-07-24 Thread Sergio
Phil Mayers escribió: Sergio wrote: Sorry, I'll do the things right jeje I haven't been reading all your emails, but what I have read is very confusing. So I'm sorry if I misunderstand. The error message seems very very clear. FreeRadius cannot verify the client certificate. This means yo

Re: definitively, I have a problem with eap-tls

2008-07-24 Thread Phil Mayers
Sergio wrote: Sorry, I'll do the things right jeje I haven't been reading all your emails, but what I have read is very confusing. So I'm sorry if I misunderstand. The error message seems very very clear. FreeRadius cannot verify the client certificate. This means you have not given it the

Re: definitively, I have a problem with eap-tls

2008-07-24 Thread Sergio
Sorry, I'll do the things right jeje Log using default configuration except: -default_eap_type = tls into eap.conf -client 192.168.0.0/24 { secret = testing123 shortname = kely } into clients.conf, and ap configuration ok (still not in the garbage) -wpa_supplican

Re: definitively, I have a problem with eap-tls

2008-07-23 Thread Sergio
Sergio escribió: Sergio escribió: HI, continuing with Reveal MAP problem with unknown ca's under eap-tls using default configuration private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem freeradius tell me this: rlm_eap_tls: <<< TLS 1.

Re: definitively, I have a problem with eap-tls

2008-07-23 Thread Sergio
Sergio escribió: HI, continuing with Reveal MAP problem with unknown ca's under eap-tls using default configuration private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem freeradius tell me this: rlm_eap_tls: <<< TLS 1.0 Handshake [lengt

definitively, I have a problem with eap-tls

2008-07-22 Thread Sergio
HI, continuing with Reveal MAP problem with unknown ca's under eap-tls using default configuration private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem freeradius tell me this: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0bdb], Certificat

problem with eap-tls authentication

2007-08-28 Thread HBA BOX
Hello, I'm using radius server and and linksys access point configured to use radius security mode and windows xp in my laptop as wlan client configured like that: network authentication: open data encryption: WEP enable IEEE 802.1x authentication for this NW EAP type: smartcard or oth

Re: problem with EAP-TLS

2007-04-06 Thread Alan DeKok
Ivan wrote: > Hi, > i am using freeradius 1.1.3 and i have a problem with eap-tls, in full > log it seems that it works, but windows xp client cannot connect This is in the FAQ. In 1.1.4 and later, there's also a long explanation in "eap.conf". Alan DeKok. -- ht

problem with EAP-TLS

2007-04-06 Thread Ivan
Hi, i am using freeradius 1.1.3 and i have a problem with eap-tls, in full log it seems that it works, but windows xp client cannot connect here is the log Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf

Re: Problem with EAP/TLS authentication

2006-03-06 Thread Robert Myers
There is a link at the bottom of every message, on that page at the bottom is a link for searching the archives via google. Good Luck. -Bob Guillaume wrote: 2006/3/6, Alan DeKok <[EMAIL PROTECTED]>: Guillaume <[EMAIL PROTECTED]> wrote: I run the freeradius version 1.0.4. Y

Re: Problem with EAP/TLS authentication

2006-03-06 Thread Guillaume
2006/3/6, Alan DeKok <[EMAIL PROTECTED]>: > Guillaume <[EMAIL PROTECTED]> wrote: > > I run the freeradius version 1.0.4. > > You should probably upgrade. > > > >> rlm_eap_tls: Received unexpected tunneled data after successful > > >> handshake. > > I recall that's a problem with machine accou

Re: Problem with EAP/TLS authentication

2006-03-06 Thread Alan DeKok
Guillaume <[EMAIL PROTECTED]> wrote: > I run the freeradius version 1.0.4. You should probably upgrade. > >> rlm_eap_tls: Received unexpected tunneled data after successful handshake. I recall that's a problem with machine accounts, or some other Windows weirdness. See the list archives.

Problem with EAP/TLS authentication

2006-03-06 Thread Guillaume
hi, i am in trouble in the configuration of my radius server, eap/tls and wifi clients, i dont know where is the error, if its in my conf or if its in my certificates... I run the freeradius version 1.0.4. When Wifi client running winXP sp2 try to connect the radius, i have this following error af

Re: problem with EAP-TLS

2006-01-29 Thread dark0s dark0s
Excuse me, I known it's off topic, but it is last post on this argument. Could you tell me a model of PCMCIA card doesn't need wpa supplicant? And not only the chipset Thanks, Saverio ___ Yahoo! Mail: gratis 1GB per i messagg

Re: problem with EAP-TLS

2006-01-26 Thread Zoltan Ori
On Thursday 26 January 2006 13:33, dark0s dark0s wrote: > Can you tell me if exist a PCMCIA card that doesn't request wpa_supplicant; > i.e. a card that authenticates directly, after the configuration of > freeradius 1.0.5 and openssl? This is off topic and has nothing to do with EAP-TLS or really

Re: problem with EAP-TLS

2006-01-26 Thread Frank Büttner
dark0s dark0s schrieb: > 1) About ctrl_interface variable, /var/run/wpa_supplicant doesn't on Windows > 2) Where do I have to insert the configuration file > 3) If I must enable only WEP, what should be the configuration file 1. the name is correct 2. where you put the the wpa_supplicant.exe fi

Re: problem with EAP-TLS

2006-01-26 Thread dark0s dark0s
Can you tell me if exist a PCMCIA card that doesn't request wpa_supplicant; i.e. a card that authenticates directly, after the configuration of freeradius 1.0.5 and openssl? Yahoo! Messenger with Voice: chiama da PC a telefono a tariffe esclusive- List info/subscribe/unsubscribe? See http://www.

Re: problem with EAP-TLS

2006-01-26 Thread dark0s dark0s
1) About ctrl_interface variable, /var/run/wpa_supplicant doesn't on Windows 2) Where do I have to insert the configuration file 3) If I must enable only WEP, what should be the configuration file Yahoo! Mail: gratis 1GB per i messaggi, antispam, antivirus, POP3- List info/subscribe/unsubscrib

Re: problem with EAP-TLS

2006-01-24 Thread Alan DeKok
dark0s dark0s <[EMAIL PROTECTED]> wrote: > Excuse me, but what is AEGIS protocol? > How can I disable the disable the binding of the > AEGIS Protocol of the network card? Please do not post off-topic messages to this list. There are other lists devoted to supplicant software. Supplicant ques

Re: problem with EAP-TLS

2006-01-24 Thread dark0s dark0s
Can you explain me better what is AEGIS protocol? Because I cannot find it on the system. Yahoo! Mail: gratis 1GB per i messaggi, antispam, antivirus, POP3- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: problem with EAP-TLS

2006-01-24 Thread Frank Büttner
dark0s dark0s schrieb: > Excuse me, but what is AEGIS protocol? > How can I disable the disable the binding of the > AEGIS Protocol of the network card? > The AEGIS protocol is the broken supplicant of your wlan card. I have only an german windows so I can't tell you how the menu name is called in

Re: problem with EAP-TLS

2006-01-24 Thread dark0s dark0s
Excuse me, but what is AEGIS protocol? How can I disable the disable the binding of the AEGIS Protocol of the network card? ___ Yahoo! Mail: gratis 1GB per i messaggi e allegati da 10MB http://mail.yahoo.it - List info/subscr

Re: problem with EAP-TLS

2006-01-24 Thread Frank Büttner
dark0s dark0s schrieb: > I have a Windows XP SP2 client, with winpcap 3.1 installed. > I have downloaded wpa_supplicant 0.5.0, but the executable wpasvc.exe > is not recognized by the system, is it possibile? > After installing winpcap, what do I have to do? > > > > > -

Re: problem with EAP-TLS

2006-01-24 Thread dark0s dark0s
I have a Windows XP SP2 client, with winpcap 3.1 installed. I have downloaded wpa_supplicant 0.5.0, but the executable wpasvc.exe is not recognized by the system, is it possibile? After installing winpcap, what do I have to do? Yahoo! Mail: gratis 1GB per i messaggi, antispam, antivirus, POP3

  1   2   >