I installed a Radius server with a EAP-TLS only configuration. I have a client.p12 file that is supposed to contain both the root-CA and the client certificate.

  1. I added the p12 key

  2. I configured the SSID but in freeradius's debug messages it seems freeradius can't verify my key/certificate.

error 20 at 0 depth lookup: unable to get local issuer certificate
(25) eap_tls: ERROR: Program returned code (2) and output 'error /tmp/radiusd/radiusd.client.XXK1l6r6: verification failed'
tls: Certificate CN (testuser@****.com) fails external verification!
(25) eap_tls: >>> send TLS 1.2  [length 0002] 
(25) eap_tls: ERROR: TLS Alert write:fatal:internal error
tls: TLS_accept: Error in error
(25) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
(25) eap_tls: ERROR: System call (I/O) error (-1)
(25) eap_tls: ERROR: TLS receive handshake failed during operation
(25) eap_tls: ERROR: [eaptls process] = fail
(25) eap: ERROR: Failed continuing EAP TLS (13) session.  EAP sub-module failed
(25) eap: Sending EAP Failure (code 4) ID 7 length 4
(25) eap: Failed in EAP select
(25)     [eap] = invalid
(25)   } # authenticate = invalid
(25) Failed to authenticate the user
(25) Using Post-Auth-Type Reject
(25) # Executing group from file /etc/freeradius/3.0/sites-enabled/***network
(25)   Post-Auth-Type REJECT {
(25) attr_filter.access_reject: EXPAND %{User-Name}
(25) attr_filter.access_reject:    --> testuser@@****..com
(25) attr_filter.access_reject: Matched entry DEFAULT at line 11
(25)     [attr_filter.access_reject] = updated
(25)   } # Post-Auth-Type REJECT = updated
(25) Delaying response for 1.000000 seconds
Waking up in 0.6 seconds.
Waking up in 0.3 seconds.
(25) Sending delayed response
(25) Sent Access-Reject Id 25 from to length 44
(25)   EAP-Message = 0x04070004
(25)   Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.8 seconds.
(20) Cleaning up request packet ID 20 with timestamp +1661
(21) Cleaning up request packet ID 21 with timestamp +1661
(22) Cleaning up request packet ID 22 with timestamp +1661
(23) Cleaning up request packet ID 23 with timestamp +1661
(24) Cleaning up request packet ID 24 with timestamp +1661
(25) Cleaning up request packet ID 25 with timestamp +1661
Ready to process requests

Question: How to test my freeradius server with my p12 key in CLI without having to setup everything from windows?


I found a solution here:

client_cert isn't necessary because the client certificate exists already in the p12 file.


        # client_cert="/tmp/clients/clientcertpem" # Useless, the certificate is already in the p12 file

Run the command: eapol_test -c eapol_test.conf.tls -a -p 1812 -s testing123 -r1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.