4

Recently I noticed that my Note 10 would no longer associate with my wifi but all other phones would. I have since resolved the issue by rerolling my certificates but cannot get the options 'Require status for all certificates' or 'Require status for untrusted certificates' to work. 'Request Status' does work as well as 'Don't validate'

'Require status for all certificates' fails with on the freeradius end with -

(36) eap: Expiring EAP session with state 0xb8be52eabb005f50
(36) eap: Finished EAP session with state 0xb8be52eabb005f50
(36) eap: Previous EAP request found for state 0xb8be52eabb005f50, released from the list
(36) eap: Peer sent packet with method EAP TLS (13)
(36) eap: Calling submodule eap_tls to process data
(36) eap_tls: Continuing EAP-TLS
(36) eap_tls: [eaptls verify] = ok
(36) eap_tls: Done initial handshake
(36) eap_tls: <<< recv TLS 1.1  [length 0002]
(36) eap_tls: ERROR: TLS Alert read:fatal:internal error
(36) eap_tls: TLS_accept: Need to read more data: error
(36) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error
(36) eap_tls: TLS - In Handshake Phase
(36) eap_tls: TLS - Application data.
(36) eap_tls: ERROR: TLS failed during operation
(36) eap_tls: ERROR: [eaptls process] = fail
(36) eap: ERROR: Failed continuing EAP TLS (13) session.  EAP sub-module failed
(36) eap: Sending EAP Failure (code 4) ID 190 length 4

'Require status for untrusted' hangs with android eventually giving up with this on the freeradius end -

(5) eap_tls: [eaptls start] = request
(5) eap: Sending EAP Request (code 1) ID 243 length 6
(5) eap: EAP session adding &reply:State = 0xcff1ecc3cf02e118
(5)     [eap] = handled
(5)   } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) Post-Auth-Type sub-section not found.  Ignoring.
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5) Sent Access-Challenge Id 247 from 192.168.45.251:1812 to 192.168.45.37:33524 length 0
(5)   EAP-Message = 0x01f300060d20
(5)   Message-Authenticator = 0x00000000000000000000000000000000
(5)   State = 0xcff1ecc3cf02e118ed54fc1c4b664912
(5) Finished request
Waking up in 4.9 seconds.
(5) Cleaning up request packet ID 247 with timestamp +19
Ready to process requests

What do I need to implement or correct so these two options will work as well?

1 Answer 1

3

"Certificate status request" is the official TLS terminology for OCSP stapling.

The Android option is very likely a direct mapping to the corresponding wpa_supplicant option (just like the "Domain" field is domain_suffix_match, and so on).

3
  • I have a (possibly) related issue: on Android 13, the 'request' option works, but the 'require' fails, which makes me think the certificate is not actually validated. I believe this can be due to the domain *.ruw.mydomain.com containing a *: do you know whether this can be the issue?
    – jj_p
    Commented Oct 26, 2022 at 20:00
  • 1
    OCSP doesn't validate hostnames (that's already done as part of the normal checks) – the purpose of OCSP is to verify that the certificate hasn't been revoked and nothing else. If "require" fails, that sounds like the EAP TLS server isn't set up to respond to the OCSP-stapling requests.
    – user1686
    Commented Oct 26, 2022 at 20:04
  • I see, thanks. Perhaps then I have not noticed this issue with wpa_supplicant on linux as i'm not explicitely enforcing ocsp there.
    – jj_p
    Commented Oct 26, 2022 at 20:15

You must log in to answer this question.