<html><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8"></head><body
text="#000000" bgcolor="#FFFFFF">
<div class="moz-text-plain" wrap="false" graphical-quote="true"
style="font-family: -moz-fixed"><pre wrap="">Hi Robert,
</pre><blockquote type="cite" style="color: #000000;"><blockquote
type="cite" style="color: #000000;"><pre wrap="">error 26 : unsupported certificate purpose
</pre></blockquote></blockquote><pre wrap=""><!---->
It seems the cert gets declined because of a problem with cert
extensions. "keyUsage" or "extendedKeyUsage" are typical candidates. In
your case, the leaf certificate "CAPF-91d43ef6" has two extensions:
Object 00: X509v3 Key Usage
Digital Signature, Key Encipherment
Object 01: X509v3 Extended Key Usage
TLS Web Server Authentication, TLS Web Client Authentication, IPSec End System
I would check if an extension is now missing/newly required, or no
longer recognized. Try check for differences in the openssl.cnf and
freeradius config files between the old Debian system and the new one.
Some EAP TLS guides (incl. Cisco) also list extensions "nonRepudiation" and "dataEncipherment", but this is just a guess since you mentioned it works on the old system.
</pre><blockquote type="cite" style="color: #000000;"><blockquote
type="cite" style="color: #000000;"><pre wrap="">I have some problems with new Cisco CAPF certs
</pre></blockquote></blockquote><pre wrap=""><!---->
What is the authenticating device? Cisco IP phone?
Cheers,
Frank
</pre></div>
</body>
</html>