topic RE: PEAP failed SSL/TLS handshake because the client rejected the radius server certificate in ExtremeWireless (WiNG)

PEAP failed SSL/TLS handshake because the client rejected the radius server certificate

Jan_van_de_Bor — Sun, 15 Oct 2017 19:25:00 GMT

Extreme ap6532 (wing 5.8) Ge1 interface configured as dot1xsupplicant (client) for wired 802.1x authentication of AccessPoint connected to cisco 2960x switch (15.2(4)E5) configured with cisco ISE 2.3 as radiusserver. During authentication of AP a radius server message "PEAP failed SSL/TLS handshake because the client rejected the radius server certificate.

Configured CA certificate chain (same as on radius server, as trustpoint on AP, but still problem exists.

Somebody experience with Extreme AP Wing 5.x configured as dot1xsupplicant ?

Please help. Thanks.

RE: PEAP failed SSL/TLS handshake because the client rejected the radius server certificate

Andrew_Webster — Sun, 15 Oct 2017 19:31:00 GMT

The client MUST trust the CA certificate that issued the Radius server's certificate. Make sure that it is in the client's Trusted root CA list.

RE: PEAP failed SSL/TLS handshake because the client rejected the radius server certificate

Jan_van_de_Bor — Sun, 15 Oct 2017 19:47:00 GMT

Tx Andrew.

It is the accesspoint itself being a radiusclient in our setup . We are configuring 802.1x on the wired network. Also AP's themselves need to be authenticated. Therefore we have configured AP's Ge1 interface as dot1xsupplicant (username/pass). I installed CA certificate chain on AP as trustpoint.

RE: PEAP failed SSL/TLS handshake because the client rejected the radius server certificate

Timo1 — Mon, 16 Oct 2017 11:56:00 GMT

Can you copy the port config you have done?

RE: PEAP failed SSL/TLS handshake because the client rejected the radius server certificate

Jan_van_de_Bor — Mon, 16 Oct 2017 12:40:00 GMT

Accesspoint AP6532 (AP6532 version 5.8.6.0-011R)

profile ap6532 default-ap6532
.....
....
interface ge1
dot1x supplicant username zebra-ap password *xyz*

tx Timo.

RE: PEAP failed SSL/TLS handshake because the client rejected the radius server certificate

Jan_van_de_Bor — Mon, 16 Oct 2017 17:58:00 GMT

Problem solved. It seemed ISE was forcing EAP/TLS where AP was expecting EAP/MD5. Therefore responding "Bad certificate (42)"

Also in radius log found: sslv3 alert bad certificate:s3_pkt.c:1493:SSL alert number 42

This error message tells: the server demands you authenticate with a certificate, and you did not do so.

Changed authentication rule on ISE to allow/ask EAP/MD5, now AP configured as dot1xsupplicant authentication successfull !