I am trying to use Freeradius 3.0 for authentication with certificates. To generate the CA, Server and Client certificate, make is available, reading a specific configuration file for each certificates (more information about it here).
The generated private key of the server and the client is encrypted by a password set in the configuration file.
-----BEGIN ENCRYPTED PRIVATE KEY-----
the encrypted private key ...
When i am restarting the radius service it fail, i get the following error (using freeradius -X) :
tls: Failed reading private key file "/etc/freeradius/3.0/certs/server.pem": error:0B080074:X509 certificate routines:X509_check_private_key:key values mismatch
At first i thought that the password provided for decryption in the file configuration (mods-enabled/eap and sites-enabled/tls) of Freeradius was wrong, but no.
When i am using openssl to decrypt the file, it is working like a charm.
root@debian:/etc/freeradius/3.0/certs# openssl rsa -in server.pem
Enter pass phrase for server.pem:
writing RSA key
-----BEGIN RSA PRIVATE KEY-----
clear certificate ...
When i am opening the pem file on a gui ubuntu, the same password is not working anymore.
I dont understand why with freeradius (and with gui) the password provided dont decrypt the certificate ? The make command to generate the certificate are build by freeradius so it should work.
makeis a standard utility and I'd bet freeradius does not provide a make 'command' but rather a file used by make which is called a makefile and standardly named Makefile, but I don't have time to search for it. ...