[RADIATOR] EAP TLS and XP machine authentication

[Hugh Irvine]

Hello Markus -

Can you please send me a copy of the configuration file and a more complete trace 4 debug showing more of what is happening?

thanks and regards

Hugh


On 23 Apr 2010, at 19:33, Markus Moeller wrote:

> Hi,
>  
>    I try to use 802.1x with XP and machine authentication.  I can see the radius request with username host/<fqdn> and then I see the radius server failing because the CN nor the subjectaltname(= <fqdn> only)  match the username.
>  
> Fri Apr 23 09:59:40 2010: DEBUG: Response type 13
> Fri Apr 23 09:59:40 2010: DEBUG: Certificate Subject Name is /DC=com/DC=DOMAIN/O=TEST/CN=host1.domain.com
> Fri Apr 23 09:59:40 2010: DEBUG: Checking subjectAltName type 2, value host1.domain.com
> Fri Apr 23 09:59:40 2010: INFO: EAP TLS client certificate subject /DC=com/DC=DOMAIN/O=TEST/CN=host1.domain.com does not match
> user name host/host1.domain.com at unknown or identity host/host1.domain.com
> Fri Apr 23 09:59:40 2010: INFO: EAP TLS certificate verification failed: application verification failure,  14579: 1 - error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned
>  
>  
> What is the right way to configure Radiator or how should the certificate be created ?
> 
> Thank you
> Markus
> _______________________________________________
> radiator mailing list
> radiator at open.com.au
> http://www.open.com.au/mailman/listinfo/radiator



NB: 

Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive (www.open.com.au/archives/radiator)?
Have you had a quick look on Google (www.google.com)?
Have you included a copy of your configuration file (no secrets), 
together with a trace 4 debug showing what is happening?

-- 
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
Includes support for reliable RADIUS transport (RadSec),
and DIAMETER translation agent.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.