Problem using ca_path to connect to a EAP-TLS network
Soh Kam Yung
Tue Dec 9 17:25:25 PST 2008
On Wed, Dec 10, 2008 at 12:56 AM, Jouni Malinen <j at w1.fi> wrote:
> On Tue, Dec 09, 2008 at 04:18:10PM +0800, Soh Kam Yung wrote:
>> I'm encountering problems connecting to a EAP-TLS network using
>> ca_path in my configuration (instead of ca_cert).
>> ca_path = "/usr/local/certs"
>> I start seeing the following error in the wpa_supplicant debug output:
>> TLS: Certificate verification failed, error 20 (unable to get local
>> issuer certificate) depth 1 for '[deleted]'
>> Am I using ca_path correctly?
> Does the directory that you point to include certificate hash files
> (symlink from a filename with the hash to the actual certificate)?
> OpenSSL requires that to find the certificates when using ca_path.
> Jouni Malinen PGP id EFC895FA
Err...no. <scratches head> I have no idea how to hash the certificate file.
My apologies, but I'm new to the world of WPA-Enterprise/OpenSSL and
not that familiar with setting up the information required for
wpa_supplicant and OpenSSL to recognised server certificates.
I have also tried to export the root certificate from my Windows
machine for the EAP-TLS network, which was in DER format. I converted
this to PEM using openssl:
> openssl x509 -inform DER -outform PEM -in test_root.cer -out test_root.pem
Is the test_root.pem file good enough, or must I generate other stuff?
Soh Kam Yung
my Google Reader Shared links:
my Google Reader Shared SFAS links:
More information about the Hostap