802.1x Authentication fails while CHAP authentication succeeds

This document (7001667) is provided subject to the disclaimer at the end of this document.

Environment

FreeRADIUS configured to use EAP in any SSL/TLS format

... and one of ...

Microsoft Windows XP Professional

... or ...

Microsoft Windows 2000

Situation

Authentication fails from a Microsoft Windows workstation, while using CHAP from the NTRadPing utility (or any service utilizing CHAP) successfully authenticate. In the FreeRADIUS "radiusd -X" output while attempting authentication :

rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate

Resolution

When rlm_eap_tls encounters an SSL failure, this is specifically because the workstation has failed to accept the SSL certificate used in the TLS-encrypted EAP communication. This is remedied using one of two methods:

Procure a third party SSL certificate that the workstations trust
Reconfigure the workstation to not trust the SSL certificate by doing the following :
1. Open the properties for the network connection on the workstation (e.g. "Wireless Network Connection Properties", "Wireless Networks", highlight the network desired, and then click on "Properties"). It should bring up a window that looks like:
2. Click on the "Authentication" tab at the top.
3. Click on the "Properties" button. It should bring up a window that looks like:
4. Ensure that "Validate server certificate" is NOT checked.

Additional Information

The SSL/TLS handshake errors occur because the workstation does not accept the SSL/TLS certificate provided by the FreeRADIUS server - usually because a self-signed SSL certificate has been used (one that has been signed by a non-recogniced certificate authority). The excerpt from the "radiusd -X" output:

rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate
TLS Alert read:fatal:bad certificate
TLS_accept:failed in SSLv3 read client certificate A
rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails.
In SSL Handshake Phase
In SSL Accept mode
rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails.
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
rlm_eap: Freeing handler
modcall[authenticate]: module "eap" returns reject for request 19

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.