<div>As you say,</div>
<div>I don't have CA file.</div>
<div>How should I do if I use EAP-TTLS authentication?</div>
<div>Now I'm blocked by the ca.pem problem.</div>
<div> </div>
<div>I had tried four methods.</div>
<div>First,</div>
<div>I just created /etc/certs directory, without ca.pem in it.</div>
<div>the result is:</div><span class="q">
<div>
<div>OpenSSLĄG tls_connection_ca_cert - Failed to load root certificates errorĄG02001002ĄGsystem libraryĄGfopenĄGNo such file or directory</div>
<div>OpenSSLĄG pending errorĄG errorĄG2006D080ĄGBIO routinesĄGBIO_new_fileĄGno such file</div>
<div>OpenSSLĄG pending errorĄG errorĄG0B084002ĄG x509 certificate routinesĄGX509_load_cert_crl_fileĄGsystem lib</div>
<div>OpenSSLĄG tls_load_ca_der - Failed load CA in DER format errorĄG02001002ĄGsystem libraryĄGfopenĄGNo such file of directory</div>
<div>OpenSSLĄG pending errorĄG errorĄG20074002ĄGBIO routinesĄGFILE_CTRLĄGsystem lib</div>
<div>OpenSSLĄG pending errorĄG errorĄG0B06F002ĄGx509 certificate routinesĄGX509_load_cert_fileĄGsystem lib</div>
<div>TLSĄG Failed to set TLS connection parameters</div>
<div>EAP-TTLSĄG Failed to initialize SSL.</div></div>
<div> </div></span>
<div>Second,</div>
<div>I created an empty file named ca.pem and placed it in /etc/certs/.</div>
<div>the result is:</div>
<div>OpenSSLĄG tls_connection_ca_cert - Failed to load root certificates errorĄG00000000ĄGlib(0)ĄGfunc(0)ĄGreason(0)</div>
<div>OpenSSLĄG tls_load_ca_der - Failed load CA in DER format errorĄG0D07207BĄGasn1 encoding routinesĄGASN1_get_objectĄGheader too long</div>
<div>OpenSSLĄG pending errorĄG errorĄG0B06F00DĄGx509 certificate routinesĄGX509_load_cert_fileĄGASN1 lib</div><span class="q">
<div>
<div>TLSĄG Failed to set TLS connection parameters</div>
<div>EAP-TTLSĄG Failed to initialize SSL.</div></div>
<div> </div></span>
<div>Third,</div>
<div>I copied the /usr/share/doc/perl-IO-Socket-SSL-1.01/certs/my-ca.pem to /etc/certs/</div>
<div>and the result is:</div>
<div>TLSĄG Certificate verification failed. error 19 (self signed certificate in certificate chain) depth 1 for '/C=CA/ST=Province/L=Some City/0=0rganization/OU=localhost/CN=Client <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:certificate/emailAddress=client@example.com'" target="_blank">
certificate/emailAddress=client@example.com'</a></div><span class="q">
<div>SSLĄG SSL3 alertĄG write (local SSL3 detected an error)ĄGfatalĄGunknown CA</div>
<div>OpenSSLĄG tls_connection_handshake - SSL_connect errorĄG14090086ĄGSSL routinesĄGSSL3_GET_SERVER_CERTIFICATEĄGcertificate verify failed</div>
<div>CTRL-EVENT-EAP-FAILURE EAP authentication failed</div>
<div> </div></span>
<div>Forth,</div>
<div>I copied the RADIUS Server's certs/demoCA/cacert.pem, and placed it in my host's /etc/certs</div>
<div>and the result is:</div>
<div>TLS: Certificate verification failed, error 10 (certificate has expired) depth 1 for '/C=CA/ST=Province/L=Some City/O=Organization/OU=localhost/CN=Client <a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:certificate/emailAddress=client@example.com'" target="_blank">
certificate/emailAddress=client@example.com'</a><br>SSL: SSL3 alert: write (local SSL3 detected an error):fatal:certificate expired<span class="q"><br>OpenSSL: tls_connection_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
<br>CTRL-EVENT-EAP-FAILURE EAP authentication failed</span></div>