I am using freeradius to test EAP-TLS. Authorization only succeeds if I specify an identity. It doesn't even have to match any fields in the client certificate. Why is that required if I have a cert and private key? I know the EAP protocol has a response message that has to include an identity string. Is there a configuration where the AS accepts an empty field?

My stack is:

  • AP (NAS): Openwrt running HostAP
  • AS: freeradius
  • supplicant: wpa_supplicant

1 Answer 1


The EAP-Identity response typically contains a username or some identifier that can be used by the AS to facilitate the authentication process.

You can set a default identity in the eap configuration file, typically located at /etc/freeradius/version number/mods-enabled/eap. Find the tls section and add the following line: identity = "default"

Replace "default" with the default identity you want to use when the client provides an empty identity.


You can configure to accept anonymous identities by modifying the 'sites-enabled/default' or 'sites-enabled/inner-tunnel' configuration files. Look for the authorize section and modify the if condition that checks the username to something like:

if (User-Name == "anonymous" || User-Name == "") {
    update control {
        Cleartext-Password := "<some-random-string>"
    update request {
        Stripped-User-Name := "anonymous"
        Realm := "NULL"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .