I'm trying to setup an EAP-TLS with latest Freeradius on Debian Buster
Used the Freeradius to make certificates
But keep running into "unknown CA" error :
(4) Found Auth-Type = eap
(4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(4) authenticate {
(4) eap: Expiring EAP session with state 0x8448c93b874cc4cb
(4) eap: Finished EAP session with state 0x8448c93b874cc4cb
(4) eap: Previous EAP request found for state 0x8448c93b874cc4cb, released from the list
(4) eap: Peer sent packet with method EAP TLS (13)
(4) eap: Calling submodule eap_tls to process data
(4) eap_tls: Continuing EAP-TLS
(4) eap_tls: [eaptls verify] = ok
(4) eap_tls: Done initial handshake
(4) eap_tls: <<< recv TLS 1.2 [length 0002]
(4) eap_tls: ERROR: TLS Alert read:fatal:unknown CA
(4) eap_tls: TLS_accept: Need to read more data: error
(4) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
(4) eap_tls: In SSL Handshake Phase
(4) eap_tls: In SSL Accept mode
(4) eap_tls: SSL Application Data
(4) eap_tls: ERROR: TLS failed during operation
(4) eap_tls: ERROR: [eaptls process] = fail
(4) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed
(4) eap: Sending EAP Failure (code 4) ID 4 length 4
(4) eap: Failed in EAP select
(4) [eap] = invalid
(4) } # authenticate = invalid
(4) Failed to authenticate the user
(4) Using Post-Auth-Type Reject
(4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(4) Post-Auth-Type REJECT {
I set up eapol_test to execute a local test and it worked fine :
eapol_test -c eap-tls.conf -a 192.168.13.130 -s whatever -o eap-tls.out
RADIUS packet matching with station
MS-MPPE-Send-Key (sign) - hexdump(len=32): 10 02 c1 45 3f cd ea a0 29 35 17 86 3e fc 00 50 2d 6a 16 4c e5 85 b2 a0 fd 95 a5 b2 d2 ea b4 33
MS-MPPE-Recv-Key (crypt) - hexdump(len=32): 5a a5 09 23 0d ce e0 f0 b4 8a bb be d7 ff 6a e7 2b 8a 6f be 84 9d 64 07 88 d7 7d 7c a1 02 07 63
decapsulated EAP packet (code=3 id=181 len=4) from RADIUS server: EAP Success
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Success
EAP: Status notification: completion (param=success)
EAP: EAP entering state SUCCESS
CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
EAPOL: IEEE 802.1X for plaintext connection; no EAPOL-Key frames required
WPA: EAPOL processing complete
Cancelling authentication timeout
State: DISCONNECTED -> COMPLETED
EAPOL: SUPP_PAE entering state AUTHENTICATED
EAPOL: SUPP_BE entering state RECEIVE
EAPOL: SUPP_BE entering state SUCCESS
EAPOL: SUPP_BE entering state IDLE
eapol_sm_cb: result=1
EAPOL: Successfully fetched key (len=32)
PMK from EAPOL - hexdump(len=32): 5a a5 09 23 0d ce e0 f0 b4 8a bb be d7 ff 6a e7 2b 8a 6f be 84 9d 64 07 88 d7 7d 7c a1 02 07 63
No EAP-Key-Name received from server
WPA: Clear old PMK and PTK
EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit
ENGINE: engine deinit
MPPE keys OK: 1 mismatch: 0
SUCCESS
Any ideas or suggestions on what might be causing the issue ?
regards yann
