<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Nur Text Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;
mso-fareast-language:EN-US;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:Consolas;
color:black;}
span.NurTextZchn
{mso-style-name:"Nur Text Zchn";
mso-style-priority:99;
mso-style-link:"Nur Text";
font-family:"Calibri",sans-serif;}
span.E-MailFormatvorlage22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.E-MailFormatvorlage23
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.E-MailFormatvorlage24
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.E-MailFormatvorlage25
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hallo Frank,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">this are bad news. The Cisco CAPF CA certifiace need TLS Web Server Authentification.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><a href="https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/212214-Tech-Note-on-CAPF-Certificate-Signed-by.html">https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/212214-Tech-Note-on-CAPF-Certificate-Signed-by.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">You mean, i sign the cert request new with adding anyExtendedKeyUsage will be work? Ir kann the root ca add the same extendedKeyUsage and resign byself?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Robert<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="color:windowtext;mso-fareast-language:DE">Von:</span></b><span style="color:windowtext;mso-fareast-language:DE"> Frank Migge [mailto:fm@frank4dd.com]
<br>
<b>Gesendet:</b> Samstag, 20. Januar 2018 13:54<br>
<b>An:</b> Gladewitz, Robert <Robert.Gladewitz@dbfz.de><br>
<b>Betreff:</b> Re: AW: [openssl-users] TLS Error in FreeRadius - eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Robert,<br>
<br>
Lets see if I get it right. Please correct me if I am misinterpreting.<br>
<br>
If an extended key usage extension such as "TLS Web Server Authentication" is set in the intermediate, its purpose conflicts with the signing purpose of an (intermediate) CA cert.<br>
<br>
RFC8250 mentions that extended key usage extension (EKU) is only meant for end entity certificates (e.g. client or server certs). If both key key usage extensions (KU) and EKU extensions exist, both need to be checked for a consistent purpose. The EKU above
could create a conflict of purpose with the KU before. In that case, the RFC requires the cert not to be used at all.<br>
<br>
In simpler words: CA certificates can't/shouldn't be also used as client or server certs, and vice versa. However, it seems that Cisco is doing exactly that, trying to achieve both functions in a single cert.<br>
<br>
This RFC violation(?) may work in a closed Cisco-world, but could fail against other products, such as FreeRadius/OpenSSL.<br>
<br>
That it used to work with an older Debian under OpenSSL 1.0.1 may have been luck. Victor mentioned that some changes to chain verification happened in versions 1.1.0 and beyond.<br>
<br>
What could be done? <br>
<br>
RFC 5280 mentions a "work-around". If the CAPF cert could be created outside of Cisco, replacing existing or adding the specific EKU called "anyExtendedKeyUsage", so it could act as a "wildcard"? Not sure if it would fix it (or breaks the Cisco side instead),
and if indeed above problem is your issue, but it may be worth a try.<br>
<br>
Frank<br>
<br>
<span style="font-size:12.0pt;mso-fareast-language:DE"><o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div style="margin-left:18.75pt;margin-top:22.5pt;margin-right:18.75pt;margin-bottom:7.5pt">
<div style="border:none;border-top:solid #EDF1F4 1.5pt;padding:8.0pt 0cm 0cm 0cm">
<div>
<p class="MsoNormal" style="vertical-align:middle"><a href="mailto:Robert.Gladewitz@dbfz.de">Gladewitz, Robert</a><o:p></o:p></p>
</div>
<p class="MsoNormal" align="right" style="text-align:right;vertical-align:middle">
<span style="color:#909AA4">Saturday, January 20, 2018 8:29 PM</span><o:p></o:p></p>
</div>
</div>
<div style="margin-left:18.0pt;margin-right:18.0pt">
<p class="MsoNormal"><span style="color:#1F497D">Hello Frank,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">why it is wron for an ca cert?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Robert</span><o:p></o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="color:windowtext;mso-fareast-language:DE">Von:</span></b><span style="color:windowtext;mso-fareast-language:DE"> Frank Migge [<a href="mailto:fm@frank4dd.com">mailto:fm@frank4dd.com</a>]
<br>
<b>Gesendet:</b> Samstag, 20. Januar 2018 04:10<br>
<b>An:</b> <a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a><br>
<b>Cc:</b> Gladewitz, Robert <a href="mailto:Robert.Gladewitz@dbfz.de"><Robert.Gladewitz@dbfz.de></a><br>
<b>Betreff:</b> Re: [openssl-users] TLS Error in FreeRadius - eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I got it wrong. The failing cert from your log is actually the intermediate, which has five extensions:<br>
<br>
>> Object 00: X509v3 Subject Key Identifier: 58:A4:EB:D9:DD:CE:A2:99:72:3B:E1:20:19:1D:40:C1:F9:D5:C2:28
<br>
>> Object 01: X509v3 Authority Key Identifier: keyid:E2:E9:20:42:29:83:C4:77:8C:87:AB:FA:4B:A1:A9:C4:CE:00:BD:39<br>
>> Object 02: X509v3 Basic Constraints: CA:TRUE, pathlen:0 <br>
>> Object 03: X509v3 Key Usage: Digital Signature, Certificate Sign, CRL Sign <br>
>> Object 04: X509v3 Extended Key Usage: TLS Web Server Authentication<br>
<br>
This is were I would check first. <br>
<br>
I am not fully sure, but believe that Extended Key Usage should *not* be there.<br>
<br>
Frank<br>
<br>
<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt"> </span><o:p></o:p></p>
</div>
<div style="margin-left:18.75pt;margin-top:22.5pt;margin-right:18.75pt;margin-bottom:7.5pt">
<div style="border:none;border-top:solid #EDF1F4 1.5pt;padding:8.0pt 0cm 0cm 0cm">
<div>
<p class="MsoNormal" style="vertical-align:middle"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><a href="mailto:fm@frank4dd.com">Frank Migge</a><o:p></o:p></span></p>
</div>
<p class="MsoNormal" align="right" style="text-align:right;vertical-align:middle">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#909AA4;mso-fareast-language:DE">Saturday, January 20, 2018 12:09 PM</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><o:p></o:p></span></p>
</div>
</div>
<div style="margin-left:18.0pt;margin-right:18.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#909AA4;mso-fareast-language:DE">I got it wrong. The failing cert from your log is actually the intermediate, which has five extensions:<br>
<br>
>> Object 00: X509v3 Subject Key Identifier: 58:A4:EB:D9:DD:CE:A2:99:72:3B:E1:20:19:1D:40:C1:F9:D5:C2:28
<br>
>> Object 01: X509v3 Authority Key Identifier: keyid:E2:E9:20:42:29:83:C4:77:8C:87:AB:FA:4B:A1:A9:C4:CE:00:BD:39<br>
>> Object 02: X509v3 Basic Constraints: CA:TRUE, pathlen:0 <br>
>> Object 03: X509v3 Key Usage: Digital Signature, Certificate Sign, CRL Sign <br>
>> Object 04: X509v3 Extended Key Usage: TLS Web Server Authentication<br>
<br>
This is were I would check first. <br>
<br>
I am not fully sure, but believe that Extended Key Usage should *not* be there.<br>
<br>
Frank<br>
<br>
<o:p></o:p></span></p>
</div>
<div style="margin-left:18.75pt;margin-top:22.5pt;margin-right:18.75pt;margin-bottom:7.5pt">
<div style="border:none;border-top:solid #EDF1F4 1.5pt;padding:8.0pt 0cm 0cm 0cm">
<div>
<p class="MsoNormal" style="vertical-align:middle"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><a href="mailto:fm@frank4dd.com">Frank Migge</a><o:p></o:p></span></p>
</div>
<p class="MsoNormal" align="right" style="text-align:right;vertical-align:middle">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#909AA4;mso-fareast-language:DE">Saturday, January 20, 2018 11:29 AM</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><o:p></o:p></span></p>
</div>
</div>
<div style="margin-left:18.0pt;margin-right:18.0pt">
<div>
<pre>Hi Robert,<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>error 26 : unsupported certificate purpose<o:p></o:p></pre>
</blockquote>
</blockquote>
<pre><o:p> </o:p></pre>
<pre>It seems the cert gets declined because of a problem with cert<o:p></o:p></pre>
<pre>extensions. "keyUsage" or "extendedKeyUsage" are typical candidates. In<o:p></o:p></pre>
<pre>your case, the leaf certificate "CAPF-91d43ef6" has two extensions:<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Object 00: X509v3 Key Usage<o:p></o:p></pre>
<pre> Digital Signature, Key Encipherment<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Object 01: X509v3 Extended Key Usage<o:p></o:p></pre>
<pre> TLS Web Server Authentication, TLS Web Client Authentication, IPSec End System<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>I would check if an extension is now missing/newly required, or no<o:p></o:p></pre>
<pre>longer recognized. Try check for differences in the openssl.cnf and<o:p></o:p></pre>
<pre>freeradius config files between the old Debian system and the new one.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Some EAP TLS guides (incl. Cisco) also list extensions "nonRepudiation" and "dataEncipherment", but this is just a guess since you mentioned it works on the old system.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>I have some problems with new Cisco CAPF certs<o:p></o:p></pre>
</blockquote>
</blockquote>
<pre><o:p> </o:p></pre>
<pre>What is the authenticating device? Cisco IP phone?<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Cheers,<o:p></o:p></pre>
<pre>Frank<o:p></o:p></pre>
</div>
</div>
<div style="margin-left:18.75pt;margin-top:22.5pt;margin-right:18.75pt;margin-bottom:7.5pt">
<div style="border:none;border-top:solid #EDF1F4 1.5pt;padding:8.0pt 0cm 0cm 0cm">
<div>
<p class="MsoNormal" style="vertical-align:middle"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><a href="mailto:openssl-users@openssl.org">Gladewitz, Robert via openssl-users</a><o:p></o:p></span></p>
</div>
<p class="MsoNormal" align="right" style="text-align:right;vertical-align:middle">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#909AA4;mso-fareast-language:DE">Friday, January 19, 2018 11:12 PM</span><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><o:p></o:p></span></p>
</div>
</div>
<div style="margin-left:18.0pt;margin-right:18.0pt">
<p class="MsoNormal">Dear OpenSSL Team,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I have some problems with new Cisco CAPF certs and freeradius tls authentification. The point is, that freeradius users see the problem on openssl implemtiation.
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoPlainText"><SNIP: DEBUG><o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: Continuing EAP-TLS<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: Peer indicated complete TLS record size will be 1432 bytes<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: Got complete TLS record (1432 bytes)<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: [eaptls verify] = length included<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: TLS_accept: SSLv3/TLS write server done<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: <<< recv TLS 1.0 Handshake [length 03c2], Certificate<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: Creating attributes from certificate OIDs<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: TLS-Cert-Serial := "1009"<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: TLS-Cert-Expiration := "380111125719Z"<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: TLS-Cert-Subject := "/C=DE/ST=Sachsen/L=Leipzig/O=DBFZ Deutsches Biomasseforschungszentrum gGmbH/OU=IT/CN=CAPF-91d43ef6"<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: TLS-Cert-Issuer := "/C=DE/ST=Sachsen/L=Leipzig/O=DBFZ Deutsches Biomasseforschungszentrum gemeinnuetzige GmbH/OU=IT/CN=DBFZ CA INTERN
<a href="mailto:ROOT/emailAddress=support@dbfz.de">ROOT/emailAddress=support@dbfz.de</a>"<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: TLS-Cert-Common-Name := "CAPF-91d43ef6"<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: ERROR: SSL says error 26 : unsupported certificate purpose<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal unsupported_certificate<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: ERROR: TLS Alert write:fatal:unsupported certificate<o:p></o:p></p>
<p class="MsoPlainText">tls: TLS_accept: Error in error<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: ERROR: System call (I/O) error (-1)<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: ERROR: TLS receive handshake failed during operation<o:p></o:p></p>
<p class="MsoPlainText">(69) eap_tls: ERROR: [eaptls process] = fail </DEBUG><o:p></o:p></p>
<p class="MsoNormal"></SNIP><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">This means, that the check of ca certificate is failed. So, bu I do not see, why. If i check the certificate by command openssl –verify, all sems to be right.
<o:p></o:p></p>
<p class="MsoPlainText"># openssl verify -verbose -CAfile /etc/freeradius/3.0/certs.8021x.ciscophone/cacert.capf.pem SEP64A0E714844E-L1.pem
<o:p></o:p></p>
<p class="MsoPlainText"># SEP64A0E714844E-L1.pem: OK<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The openssl version is Debian based 1.1.0g-2. But the same error is happening on 1.1.0f also.
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Older freeradius version 2 on Debian 8/openssl 1.0.1t-1+deb8u7 working fine without this problem (by using the same certificates)<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The ca certificate are signed by an intern ca. Can anyone see the error??<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Robert<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;mso-fareast-language:DE"><o:p> </o:p></span></p>
</div>
</body>
</html>