OpenSSL must be installed to use either EAP-TLS, EAP-TTLS, or PEAP! |
When using EAP-TLS, both the Authentication Server and all the Supplicants (clients) need certificates [RFC2459] . Using EAP-TTLS or PEAP, only the Authentication Server requires certificates; Supplicant certificates are optional.
You get certificates from the local certificate authority (CA). If there is no local CA available, OpenSSL may be used to generate self-signed certificates.
Included with the FreeRADIUS source are some helper scripts to generate self-signed certificates. The scripts are located under the scripts/ folder included with the FreeRADIUS source:
CA.all is a shell script that generates certificates based on some questions it ask. CA.certs generates certificates non-interactively based on pre-defined information at the start of the script.
The scripts uses a Perl script called CA.pl, included with OpenSSL. The path to this Perl script in CA.all and CA.certs may need to be changed to make it work. |
More information on how to generate your own certificates can be found in the SSL certificates HOWTO. |