The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <stefan.winter AT restena.lu>]

Hi,

> ... this makes me think that this is the EAP-TTLS/PEAP TLS-1.2
> incompatibility in FreeRADIUS pre 2.2.9 and pre 3.0.10.

Adding to the technobabble from my earlier mail, for the failing
attempts I also see mighty strange packet flows:

    [time_millisec] => 6349.2040634155
    [packetcount] => Array
        (
            [1] => 50
            [11] => 50
        )

    [packetflow] => Array
        (
            [0] => 1
            [1] => 11
            [2] => 1
            [3] => 11
            [4] => 1
            [5] => 11
            [6] => 1
            [7] => 11
            [8] => 1
            [9] => 11
            [10] => 1
            [11] => 11
            [12] => 1
            [13] => 11
            [14] => 1
            [15] => 11
            [16] => 1
            [17] => 11
            [18] => 1
            [19] => 11
            [20] => 1
            [21] => 11
            [22] => 1
            [23] => 11
            [24] => 1
            [25] => 11
            [26] => 1
            [27] => 11
            [28] => 1
            [29] => 11
            [30] => 1
            [31] => 11
            [32] => 1
            [33] => 11
            [34] => 1
            [35] => 11
            [36] => 1
            [37] => 11
            [38] => 1
            [39] => 11
            [40] => 1
            [41] => 11
            [42] => 1
            [43] => 11
            [44] => 1
            [45] => 11
            [46] => 1
            [47] => 11
            [48] => 1
            [49] => 11
            [50] => 1
            [51] => 11
            [52] => 1
            [53] => 11
            [54] => 1
            [55] => 11
            [56] => 1
            [57] => 11
            [58] => 1
            [59] => 11
            [60] => 1
            [61] => 11
            [62] => 1
            [63] => 11
            [64] => 1
            [65] => 11
            [66] => 1
            [67] => 11
            [68] => 1
            [69] => 11
            [70] => 1
            [71] => 11
            [72] => 1
            [73] => 11
            [74] => 1
            [75] => 11
            [76] => 1
            [77] => 11
            [78] => 1
            [79] => 11
            [80] => 1
            [81] => 11
            [82] => 1
            [83] => 11
            [84] => 1
            [85] => 11
            [86] => 1
            [87] => 11
            [88] => 1
            [89] => 11
            [90] => 1
            [91] => 11
            [92] => 1
            [93] => 11
            [94] => 1
            [95] => 11
            [96] => 1
            [97] => 11
            [98] => 1
            [99] => 11
        )

That's 50(!) Access-Requests and Access-Challenges going back and forth,
until one of the two ends of the conversation, or an intermediate proxy,
looses interest.

So... something's definitely wrong. But not the cert probably.

I'd again advise towards an upgrade to 2.2.9 / 3.0.10.

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0x8A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature