Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    FreeRadius CA Validation Broken 2.4.5

    Scheduled Pinned Locked Moved pfSense Packages
    26 Posts 3 Posters 2.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      strangegopher
      last edited by

      @johnpoz just tested cert again, this time i didn't enter fqdn/hostname and it worked! I just wish CA validation worked.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        Have no idea why you say it doesn't are you saying freerad throws error when you enable it - or that you can not auth?? I can not actually test until get home... But freerad doesn't have any problem with me turning on the CA and just putting in its CN.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • S
          strangegopher
          last edited by

          It does not auth, it throws an error that the CA attributes don't match and then prints the attributes it is checking against and the attributes it sees.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            When does it throw that error - when client actually tries and auths.

            0_1540847513852_CAvalidation.png

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • S
              strangegopher
              last edited by

              0_1540850903279_Annotation.png

              Mon Oct 29 15:05:57 2018 : Auth: tls: Certificate issuer (/CN=test.ma/C=CA/ST=BC/L=Delta/O=Family) does not match specified value (/C=CA/ST=BC/L=Delta/O=Family/emailAddress=admin@mycompany.com/CN=test.ma)!
              Mon Oct 29 15:05:57 2018 : ERROR: (6) eap_tls: ERROR: TLS Alert write:fatal:internal error
              Mon Oct 29 15:05:57 2018 : Error: tls: TLS_accept: Error in error
              Mon Oct 29 15:05:57 2018 : Auth: (6) Login incorrect (Failed retrieving values required to evaluate condition): [Robin/<via Auth-Type = eap>] (from client LoudBounce port 0 cli 10-CD-B6-03-C4-96) Robin tried to connect
              Mon Oct 29 15:06:07 2018 : Auth: tls: Certificate issuer (/CN=test.ma/C=CA/ST=BC/L=Delta/O=Family) does not match specified value (/C=CA/ST=BC/L=Delta/O=Family/emailAddress=admin@mycompany.com/CN=test.ma)!
              Mon Oct 29 15:06:07 2018 : ERROR: (12) eap_tls: ERROR: TLS Alert write:fatal:internal error
              Mon Oct 29 15:06:07 2018 : Error: tls: TLS_accept: Error in error
              Mon Oct 29 15:06:07 2018 : Auth: (12) Login incorrect (Failed retrieving values required to evaluate condition): [Robin/<via Auth-Type = eap>] (from client WarPigeons port 0 cli 10-CD-B6-03-C4-96) Robin tried to connect
              
              
              S 1 Reply Last reply Reply Quote 0
              • S
                strangegopher @strangegopher
                last edited by

                maybe empty email should not be treated as admin@mycompany.com

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  @strangegopher said in FreeRadius CA Validation Broken 2.4.5:

                  emailAddress=admin@mycompany.com

                  Yeah where did that come from?? is freerad doing that? Pfsense? Just woke up - have not had time to test yet.. Got to change my wireless to point to the new radius server, etc.

                  edit: Ok yeah this seems to be something with the freerad package.. .Its pulling info that is not there

                  Oct 30 03:10:28 	radiusd 	28048 	tls: Certificate issuer (/CN=newfreerad) does not match specified value (/C=US/ST=Texas/L=Austin/O=My Company Ltd/emailAddress=admin@mycompany.com/CN=newfreerad)! 
                  

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • S
                    strangegopher
                    last edited by

                    When I removed freeradius and then CA and all the certs and re-installed it, it auto generated a CA and server cert. Not 100% sure but looks a lot like info in those default certs.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by johnpoz

                      yeah I thought I had posted the default certs... Is in the config.. Posted above - but that info doesn't match what is in the default cert created either.

                      0_1540887486556_eapconf.png

                      Looking to see now if you man edit the conf if can be a work around.. The package needs to be adjusted to not check for stuff that is not being used.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        Ok.. If you edit the conf directly and restart freerad it works.

                        Oct 30 03:24:17 	radiusd 	6180 	(12) Login OK: [testiphone245] (from client uap-pro port 0 cli D0-C5-F3-1F-EB-FF) 192.168.2.2 
                        

                        0_1540887987099_newconf.png

                        Going to need to file a bug report on the freerad package.. Not sure who maintains that - but maybe @jimp can help.

                        Thanks for bringing this up - might have gone unnoticed.. Prob not a lot of people setting up eap-tls ;) With new certs.. I prob would fo updated and still be using my certs and ca from before... Which have all that info in there because it use to be required by the gui.. Since the certs good for like 10 years could of gone awhile before changed ;)

                        edit: I wonder if that gets loaded in by default on package load.. And just doesn't get overwritten when fields are left blank?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        1 Reply Last reply Reply Quote 0
                        • S
                          strangegopher
                          last edited by

                          I think that the values are hardcoded in. I tried entering email and then removing the email with same results.

                          Do you want me to make a bug report or do you want to do it?

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            There might already be a report of this? Have not had time to check yet. Also be nice if @jimp could chime in on his thoughts on this.. Not sure if he is the specific developer for freerad package - but for sure his insight would be very useful.

                            But sure go for submitting report - reference this thread for sure.. I also want to take a look at the code for the freerad package.. Might be able to spot where the problem is - that is always helpful in the report. etc.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            1 Reply Last reply Reply Quote 0
                            • jimpJ
                              jimp Rebel Alliance Developer Netgate
                              last edited by

                              It isn't hardcoded but it's trying to use fields that may not exist:

                              freeradius.inc:1258:		$vareapconfcheckcertissuer = "check_cert_issuer = " . '"' . "/C={$vareapconfcountry}/ST={$vareapconfstate}/L={$vareapconfcity}/O={$vareapconforganization}/emailAddress={$vareapconfemail}/CN={$vareapconfcommonname}" . '"';
                              

                              Shouldn't be too hard to fix, but does need an issue to track it in Redmine.

                              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              1 Reply Last reply Reply Quote 0
                              • S
                                strangegopher
                                last edited by

                                Issue created
                                https://redmine.pfsense.org/issues/9082

                                1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  This should be much better now. Give it another try.

                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  S 1 Reply Last reply Reply Quote 0
                                  • S
                                    strangegopher @jimp
                                    last edited by

                                    @jimp thanks for the fix. It works now. 😃

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.