Hi Nathan, Let’s take this one step at a time.
Both PEAP and EAP-TLS are configured through /usr/local/pf/radiusd/eap.conf. Please paste that file for our perusal. Essentially, when using either the server certificate must be valid. Which means that the supplicant must be able to validate the chain of trust all the way up to a known trusted root. So if your server certificate was signed by an intermdiate cert (itself signed by a trusted root CA) you will need to provide the supplicant with both the server cert and the intermediate so that the chain is complete. The usual way to do that is to concatenate both the server and intermediate certificate in the same file to which you then point FreeRADIUS (as it’s server cert file). Regards, -- Louis Munro [email protected] :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org) > On Apr 7, 2016, at 6:57 , Nathan, Josh <[email protected]> wrote: > > Has anyone else come across this, or is it time for a rebuild? > > It makes me wonder if something similar is happening even with the TLS > connection because Windows won't connect even if I turn off Server > Certificate Validation. When I tell the Windows Provisioner that it's a PEAP > connection, the CA install fails. All of this is on PacketFence 5.5.2, > sitting on CentOS 6.7. > > I can actually just tell my Android to connect to the WPA2-Enterprise > network, and it'll hash out the PEAP without trouble even if I don't use a > provisioner. I'll confess I've only tried with a provisioner on iOS, but it > works... I just am presented somehow with the default RADIUS certificate with > all the bogus information (country: FR, locality: Somewhere, CA: Example > Certificate Authority, etc). > > Thanks, > Joshua Nathan > Level 3 IT Support and Development > Black Forest Academy > +49 (0) 7626-9161-630 > > > On Wed, Apr 6, 2016 at 4:21 PM, Nathan, Josh <[email protected] > <mailto:[email protected]>> wrote: > OK, so I've been having no luck with getting EAP-TLS to work properly with my > Windows computers, but I'm interested in testing PEAP. However, I can see > from my iPad that RADIUS always hands out its own self-made CA cert for PEAP. > I've even removed the entire raddb/certs directory, restarted radius, and it > still somehow pulls out its own cert. I have the certs I made with the > PacketFence PKI setup in the eap.conf file, but I'm guessing they're not > applying because they're contained within the tls block. I tried copying > down the line for the CA file into the peap block, but it didn't make a > difference. Is this tree even with barking down? How do I direct the cert > to be used when PEAP is in use? > > Thanks, > Joshua Nathan > Level 3 IT Support and Development > Black Forest Academy > +49 (0) 7626-9161-630 <tel:%2B49%20%280%29%207626-9161-630> > > > ------------------------------------------------------------------------------ > _______________________________________________ > PacketFence-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/packetfence-users
------------------------------------------------------------------------------
_______________________________________________ PacketFence-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/packetfence-users
