I didn't send the entire log. The next lines indicate failure, but I think it's because my server sends an Access-Reject:<br><br>EAPOL: SUPP_BE entering state RECEIVE <br>
Received 44 bytes from RADIUS server <br>Received RADIUS message <br>
RADIUS message: code=3 (Access-Reject) identifier=1 length=44 <br> Attribute 79 (EAP-Message) length=6 <br>
Value: 04 02 00 04 <br> Attribute 80 (Message-Authenticator) length=18 <br>
Value: 4c 69 e1 e2 28 03 5f 02 0d 5b 70 0d 73 36 ba 18 <br>STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.09 sec <br>
<br>RADIUS packet matching with station <br>
decapsulated EAP packet (code=4 id=2 len=4) from RADIUS server: EAP Failure <br>EAPOL: Received EAP-Packet frame <br>
EAPOL: SUPP_BE entering state REQUEST <br>EAPOL: getSuppRsp <br>
EAP: EAP entering state RECEIVED <br>EAP: Received EAP-Failure <br>
EAP: Workaround for unexpected identifier field in EAP Success: reqId=2 lastId=1 (these are supposed to be same) <br>EAP: EAP entering state FAILURE <br>
CTRL-EVENT-EAP-FAILURE EAP authentication failed <br>EAPOL: SUPP_PAE entering state HELD <br>
EAPOL: SUPP_BE entering state RECEIVE <br>EAPOL: SUPP_BE entering state FAIL <br>
EAPOL: SUPP_BE entering state IDLE <br>eapol_sm_cb: success=0 <br>
EAPOL: EAP key not available <br>EAPOL: EAP key not available <br>
EAP: deinitialize previously used EAP method (13, TLS) at EAP deinit <br>ENGINE: engine deinit <br>
MPPE keys OK: 0 mismatch: 2 <br>FAILURE <br><br>I am going to look into the errors generated by my server. But first I need to be sure that certificates are ok on both sides.<br>
<br>But you confused me with something. You said that I don't need to set a server certificate for the client. But EAP-TLS requires both client and server certificates. On the freeradius for example i have specified the path of the server certificate in eap.conf file - tls module. So I guess eapol_test is looking after the server certificate in the case of EAP-TLS, right?<br>
Please clarify this for me and excuse my questions that might sound dumb for you.<br> <br><br><br><div class="gmail_quote">
On Fri, Jun 13, 2008 at 4:41 PM, Jouni Malinen <<a href="mailto:j@w1.fi" target="_blank">j@w1.fi</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>On Fri, Jun 13, 2008 at 03:44:59PM +0200, Dana Blanaru wrote:<br>
<br>
> Though I have errors related to the server certificate... The server<br>
> certificate (server_keycert.pem: the certificate and private key are in the<br>
> same file) is on the server side, but maybe eapol_test expects it to be at a<br>
> specific path? Or to be in a different format?<br>
<br>
</div>Server? You should not need to configure server certificate (and<br>
certainly not the server private key) for the client. Anyway, the<br>
"errors" here are actually warnings. wpa_supplicant/eapol_test asks<br>
OpenSSL to first load the file as a DER file and that fails since you<br>
are using PEM format. When OpenSSL is asked to load the data in PEM<br>
format, that goes through without problems. In other words, the log you<br>
sent did not indicate any real problems.<br>
<font color="#888888"><br>
--<br>
</font><div><div></div><div>Jouni Malinen PGP id EFC895FA<br>
_______________________________________________<br>
HostAP mailing list<br>
<a href="mailto:HostAP@lists.shmoo.com" target="_blank">HostAP@lists.shmoo.com</a><br>
<a href="http://lists.shmoo.com/mailman/listinfo/hostap" target="_blank">http://lists.shmoo.com/mailman/listinfo/hostap</a><br>
</div></div></blockquote></div><br>