“Certificate not trusted error” for eap-tls Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 23, 2019 at 00:00UTC (8:00pm US/Eastern) Come Celebrate our 10 Year Anniversary!How to inspect remote SMTP server's TLS certificate?Issues with LDAP authentication over SSL (ldaps)Internet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0TLS 1.0 handshake fails in Windows Server 2012 R2Why is server FIN'ing after starting TLS session?Is it possible to configure ARR to make TLS 1.2 outgoing connections in Server 2008 R2?Stunnel “wrong version number” error with TLS-PSKTLS 1.2 client hello triggers TCP Reset from 2012 R2IIS 8.5 server not accepting a TLS 1.0 connection from Windows Server 2003TLS 1.0 still being used in IIS after it's been disabled
Trademark violation for app?
Is there hard evidence that the grant peer review system performs significantly better than random?
Did Deadpool rescue all of the X-Force?
Putting class ranking in CV, but against dept guidelines
Is grep documentation about ignoring case wrong, since it doesn't ignore case in filenames?
Is CEO the "profession" with the most psychopaths?
How do living politicians protect their readily obtainable signatures from misuse?
How to write this math term? with cases it isn't working
An adverb for when you're not exaggerating
Central Vacuuming: Is it worth it, and how does it compare to normal vacuuming?
What's the meaning of "fortified infraction restraint"?
Chinese Seal on silk painting - what does it mean?
Why is Nikon 1.4g better when Nikon 1.8g is sharper?
Drawing without replacement: why is the order of draw irrelevant?
Sending unknown callers to voice mail automatically?
Why do early math courses focus on the cross sections of a cone and not on other 3D objects?
Selecting user stories during sprint planning
How to react to hostile behavior from a senior developer?
Performance gap between vector<bool> and array
Question about debouncing - delay of state change
What does it mean that physics no longer uses mechanical models to describe phenomena?
Project Euler #1 in C++
How can I reduce the gap between left and right of cdot with a macro?
What is the topology associated with the algebras for the ultrafilter monad?
“Certificate not trusted error” for eap-tls
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 23, 2019 at 00:00UTC (8:00pm US/Eastern)
Come Celebrate our 10 Year Anniversary!How to inspect remote SMTP server's TLS certificate?Issues with LDAP authentication over SSL (ldaps)Internet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0TLS 1.0 handshake fails in Windows Server 2012 R2Why is server FIN'ing after starting TLS session?Is it possible to configure ARR to make TLS 1.2 outgoing connections in Server 2008 R2?Stunnel “wrong version number” error with TLS-PSKTLS 1.2 client hello triggers TCP Reset from 2012 R2IIS 8.5 server not accepting a TLS 1.0 connection from Windows Server 2003TLS 1.0 still being used in IIS after it's been disabled
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I'm setting up freeradius as the authentication server for 802.1x.
While testing the config using rad_eap_test, the server returns the following error:
[tls] <<< TLS 1.0 Handshake [length 0491], Certificate
--> verify error:num=27:certificate not trusted
[tls] >>> TLS 1.0 Alert [length 0002], fatal bad_certificate
TLS Alert write:fatal:bad certificate
TLS_accept: error in SSLv3 read client certificate B
rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
SSL: SSL_read failed in a system call (-1), TLS session fails.
TLS receive handshake failed during operation
Now, I'm not sure which certificate it is referring to. I've created my own CA from which I have issued a server and client certificate. Is there a way of tracking down which certificate is causing the error?
tls 802.1 freeradius2
asked Mar 31 '14 at 5:19
Ben Jaguar MarshallBen Jaguar Marshall
1216
add a comment |
I'm setting up freeradius as the authentication server for 802.1x.
While testing the config using rad_eap_test, the server returns the following error:
[tls] <<< TLS 1.0 Handshake [length 0491], Certificate
--> verify error:num=27:certificate not trusted
[tls] >>> TLS 1.0 Alert [length 0002], fatal bad_certificate
TLS Alert write:fatal:bad certificate
TLS_accept: error in SSLv3 read client certificate B
rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
SSL: SSL_read failed in a system call (-1), TLS session fails.
TLS receive handshake failed during operation
Now, I'm not sure which certificate it is referring to. I've created my own CA from which I have issued a server and client certificate. Is there a way of tracking down which certificate is causing the error?
tls 802.1 freeradius2
asked Mar 31 '14 at 5:19
Ben Jaguar MarshallBen Jaguar Marshall
1216
add a comment |
I'm setting up freeradius as the authentication server for 802.1x.
While testing the config using rad_eap_test, the server returns the following error:
[tls] <<< TLS 1.0 Handshake [length 0491], Certificate
--> verify error:num=27:certificate not trusted
[tls] >>> TLS 1.0 Alert [length 0002], fatal bad_certificate
TLS Alert write:fatal:bad certificate
TLS_accept: error in SSLv3 read client certificate B
rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
SSL: SSL_read failed in a system call (-1), TLS session fails.
TLS receive handshake failed during operation
Now, I'm not sure which certificate it is referring to. I've created my own CA from which I have issued a server and client certificate. Is there a way of tracking down which certificate is causing the error?
tls 802.1 freeradius2
asked Mar 31 '14 at 5:19
Ben Jaguar MarshallBen Jaguar Marshall
1216
I'm setting up freeradius as the authentication server for 802.1x.
While testing the config using rad_eap_test, the server returns the following error:
[tls] <<< TLS 1.0 Handshake [length 0491], Certificate
--> verify error:num=27:certificate not trusted
[tls] >>> TLS 1.0 Alert [length 0002], fatal bad_certificate
TLS Alert write:fatal:bad certificate
TLS_accept: error in SSLv3 read client certificate B
rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
SSL: SSL_read failed in a system call (-1), TLS session fails.
TLS receive handshake failed during operation
Now, I'm not sure which certificate it is referring to. I've created my own CA from which I have issued a server and client certificate. Is there a way of tracking down which certificate is causing the error?
tls 802.1 freeradius2
tls 802.1 freeradius2
asked Mar 31 '14 at 5:19
Ben Jaguar MarshallBen Jaguar Marshall
1216
asked Mar 31 '14 at 5:19
Ben Jaguar MarshallBen Jaguar Marshall
1216
asked Mar 31 '14 at 5:19
Ben Jaguar MarshallBen Jaguar Marshall
1216
asked Mar 31 '14 at 5:19
Ben Jaguar MarshallBen Jaguar Marshall
1216
asked Mar 31 '14 at 5:19
Ben Jaguar MarshallBen Jaguar Marshall
1216
1216
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
The easiest way to verify the certificate, without getting sidetracked by other Radius problems, is to use openssl s_client.
Here's an example invocations:
openssl s_client -connect authserver.example.com:port -cert /path/to/clientcert.pem -CAPath /path/to/CAcerts/
In this case, it's likely that you've not included the CA certificate for the client, the server, or both. If the server and client don't know where to find them, they can't verify the certificates issued by that CA.
answered Mar 31 '14 at 5:59
Jenny DJenny D
24.2k116196
I just tried that and it worked fine. I checked the permissions and used openssl s_server under the freerad user and that worked. I tried putting a bad filename in the config and it didn't run, so I'm thinking the client cert. Not sure where to go from here
– Ben Jaguar Marshall
Mar 31 '14 at 10:10
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f585551%2fcertificate-not-trusted-error-for-eap-tls%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The easiest way to verify the certificate, without getting sidetracked by other Radius problems, is to use openssl s_client.
Here's an example invocations:
openssl s_client -connect authserver.example.com:port -cert /path/to/clientcert.pem -CAPath /path/to/CAcerts/
In this case, it's likely that you've not included the CA certificate for the client, the server, or both. If the server and client don't know where to find them, they can't verify the certificates issued by that CA.
answered Mar 31 '14 at 5:59
Jenny DJenny D
24.2k116196
I just tried that and it worked fine. I checked the permissions and used openssl s_server under the freerad user and that worked. I tried putting a bad filename in the config and it didn't run, so I'm thinking the client cert. Not sure where to go from here
– Ben Jaguar Marshall
Mar 31 '14 at 10:10
add a comment |
The easiest way to verify the certificate, without getting sidetracked by other Radius problems, is to use openssl s_client.
Here's an example invocations:
openssl s_client -connect authserver.example.com:port -cert /path/to/clientcert.pem -CAPath /path/to/CAcerts/
In this case, it's likely that you've not included the CA certificate for the client, the server, or both. If the server and client don't know where to find them, they can't verify the certificates issued by that CA.
answered Mar 31 '14 at 5:59
Jenny DJenny D
24.2k116196
I just tried that and it worked fine. I checked the permissions and used openssl s_server under the freerad user and that worked. I tried putting a bad filename in the config and it didn't run, so I'm thinking the client cert. Not sure where to go from here
– Ben Jaguar Marshall
Mar 31 '14 at 10:10
add a comment |
The easiest way to verify the certificate, without getting sidetracked by other Radius problems, is to use openssl s_client.
Here's an example invocations:
openssl s_client -connect authserver.example.com:port -cert /path/to/clientcert.pem -CAPath /path/to/CAcerts/
In this case, it's likely that you've not included the CA certificate for the client, the server, or both. If the server and client don't know where to find them, they can't verify the certificates issued by that CA.
answered Mar 31 '14 at 5:59
Jenny DJenny D
24.2k116196
The easiest way to verify the certificate, without getting sidetracked by other Radius problems, is to use openssl s_client.
Here's an example invocations:
openssl s_client -connect authserver.example.com:port -cert /path/to/clientcert.pem -CAPath /path/to/CAcerts/
In this case, it's likely that you've not included the CA certificate for the client, the server, or both. If the server and client don't know where to find them, they can't verify the certificates issued by that CA.
answered Mar 31 '14 at 5:59
Jenny DJenny D
24.2k116196
answered Mar 31 '14 at 5:59
Jenny DJenny D
24.2k116196
answered Mar 31 '14 at 5:59
Jenny DJenny D
24.2k116196
answered Mar 31 '14 at 5:59
Jenny DJenny D
24.2k116196
24.2k116196
I just tried that and it worked fine. I checked the permissions and used openssl s_server under the freerad user and that worked. I tried putting a bad filename in the config and it didn't run, so I'm thinking the client cert. Not sure where to go from here
– Ben Jaguar Marshall
Mar 31 '14 at 10:10
add a comment |
I just tried that and it worked fine. I checked the permissions and used openssl s_server under the freerad user and that worked. I tried putting a bad filename in the config and it didn't run, so I'm thinking the client cert. Not sure where to go from here
– Ben Jaguar Marshall
Mar 31 '14 at 10:10
I just tried that and it worked fine. I checked the permissions and used openssl s_server under the freerad user and that worked. I tried putting a bad filename in the config and it didn't run, so I'm thinking the client cert. Not sure where to go from here
– Ben Jaguar Marshall
Mar 31 '14 at 10:10
I just tried that and it worked fine. I checked the permissions and used openssl s_server under the freerad user and that worked. I tried putting a bad filename in the config and it didn't run, so I'm thinking the client cert. Not sure where to go from here
– Ben Jaguar Marshall
Mar 31 '14 at 10:10
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f585551%2fcertificate-not-trusted-error-for-eap-tls%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
