134 lines
4.9 KiB
Markdown
134 lines
4.9 KiB
Markdown
|
|
The error **"TLS Alert: fatal: unknown CA"** indicates that the client (your phone) is trying to establish a **TLS connection** with the FreeRADIUS server, but it **cannot verify the server's certificate** because the **CA (Certificate Authority)** is not trusted. This is a **common issue when using PEAP (Protected Extensible Authentication Protocol)** with TLS. Let's fix it step by step.
|
|
|
|
---
|
|
|
|
### **1. Understand the Root Cause**
|
|
- **PEAP (PEAP-MSCHAPv2)** requires **TLS** for secure communication.
|
|
- Your phone is trying to connect to the FreeRADIUS server using **PEAP**, but the server is not presenting a **trusted certificate**.
|
|
- The client (phone) is not trusting the **CA** that signed the server's certificate.
|
|
|
|
---
|
|
|
|
### **2. Fix: Configure TLS for PEAP on FreeRADIUS**
|
|
You need to **set up a valid TLS certificate** for the FreeRADIUS server. Here's how:
|
|
|
|
#### **A. Generate a Self-Signed Certificate (For Testing)**
|
|
If you're in a testing environment, you can create a **self-signed certificate**. This will work for testing but won't be trusted by phones (unless manually added).
|
|
|
|
1. **Generate a private key and certificate:**
|
|
```bash
|
|
openssl req -x509 -newkey rsa:2048 -keyout /etc/freeradius/certs/your_radius_server.key -out /etc/freeradius/certs/your_radius_server.crt -days 365 -nodes
|
|
```
|
|
- Replace `your_radius_server.crt` and `your_radius_server.key` with your server's certificate and key.
|
|
|
|
2. **Set correct permissions:**
|
|
```bash
|
|
chown -R freeradius:freeradius /etc/freeradius/certs/
|
|
chmod 600 /etc/freeradius/certs/your_radius_server.key
|
|
chmod 644 /etc/freeradius/certs/your_radius_server.crt
|
|
```
|
|
|
|
#### **B. Configure FreeRADIUS to Use the Certificate**
|
|
Update `/etc/freeradius/eap.conf` to use the certificate:
|
|
|
|
```ini
|
|
eap {
|
|
default_eap_type = peap
|
|
timer_expire = 60
|
|
max_sessions = 256
|
|
|
|
peap {
|
|
# Path to your certificate and key
|
|
certificate = /etc/freeradius/certs/your_radius_server.crt
|
|
private_key = /etc/freeradius/certs/your_radius_server.key
|
|
ca_list = /etc/freeradius/certs/ca.crt # Optional: If you're using a chain
|
|
dh_file = /etc/freeradius/certs/dh2048.pem # Optional: Diffie-Hellman parameters
|
|
}
|
|
}
|
|
```
|
|
|
|
- If you're using a **self-signed certificate**, skip the `ca_list` line.
|
|
- If you're using a **trusted CA**, ensure the `ca_list` contains the CA's certificate.
|
|
|
|
#### **C. Generate Diffie-Hellman Parameters (Optional)**
|
|
For stronger TLS security:
|
|
```bash
|
|
openssl dhparam -out /etc/freeradius/certs/dh2048.pem 2048
|
|
```
|
|
|
|
---
|
|
|
|
### **3. Ensure the Client (Phone) Trusts the Certificate**
|
|
If you're using a **self-signed certificate**, the phone must trust it manually. Here's how:
|
|
|
|
#### **A. Export the Server's Certificate**
|
|
1. Use `openssl` to extract the certificate from the `.crt` file:
|
|
```bash
|
|
openssl x509 -in /etc/freeradius/certs/your_radius_server.crt -outform der -out /path/to/cert.der
|
|
```
|
|
|
|
2. Convert it to PEM format (optional):
|
|
```bash
|
|
openssl x509 -in your_radius_server.crt -out your_radius_server.pem
|
|
```
|
|
|
|
#### **B. Install the Certificate on the Phone**
|
|
- **Android**:
|
|
1. Go to **Settings > Security > Trusted Credentials > User Certificates**.
|
|
2. Import the `.der` or `.pem` file.
|
|
- **iOS**:
|
|
1. Go to **Settings > General > About > Certificate Trust Settings**.
|
|
2. Add the certificate to the trusted list (may require a certificate from a trusted CA).
|
|
|
|
#### **C. Use a Trusted CA (Recommended for Production)**
|
|
If you're using a certificate from a **trusted CA** (e.g., Let's Encrypt), ensure:
|
|
- The certificate is correctly installed.
|
|
- The **CA chain** is complete (e.g., intermediate certificates are included).
|
|
- The phone's trust store includes the CA's certificate.
|
|
|
|
---
|
|
|
|
### **4. Verify FreeRADIUS TLS Configuration**
|
|
1. **Restart FreeRADIUS**:
|
|
```bash
|
|
systemctl restart freeradius
|
|
```
|
|
|
|
2. **Check Logs for TLS Errors**:
|
|
```bash
|
|
tail -f /var/log/freeradius/radius.log
|
|
```
|
|
Look for:
|
|
- `TLS: Server certificate is not trusted`
|
|
- `TLS: No trusted certificate found`
|
|
|
|
3. **Test with `radtest`** (Ensure PEAP is working):
|
|
```bash
|
|
radtest testuser password 10.56.1.251 0 YOUR_SHARED_SECRET
|
|
```
|
|
|
|
---
|
|
|
|
### **5. Advanced: Debug TLS Handshake**
|
|
If the issue persists, enable **TLS debugging** in `eap.conf`:
|
|
```ini
|
|
eap {
|
|
debug = yes
|
|
...
|
|
}
|
|
```
|
|
Then check the logs for detailed TLS handshake errors.
|
|
|
|
---
|
|
|
|
### **Summary of Fixes**
|
|
| Step | Action |
|
|
|------|--------|
|
|
| 1 | Generate a valid TLS certificate (self-signed or trusted CA) |
|
|
| 2 | Configure FreeRADIUS to use the certificate in `eap.conf` |
|
|
| 3 | Install the certificate on the phone (or ensure the CA is trusted) |
|
|
| 4 | Restart FreeRADIUS and verify TLS is working |
|
|
| 5 | Debug with `debug = yes` if issues persist |
|
|
|
|
After these steps, the **"unknown CA"** error should resolve, and your phone should be able to connect securely via PEAP. Let me know if you need help with certificate chains or CA trust setup! 🚀 |