Re: FreeRADIUS 3.2.8 with EAP-FAST: MS-CHAP2-Response is incorrect

On Fri, Jan 9, 2026 at 12:02 PM Dennis Bland <[email protected]>
wrote:
>
> On Fri, Jan 9, 2026 at 2:24 PM Alan DeKok <[email protected]> wrote:
> >
> > On Jan 9, 2026, at 12:32 AM, Dennis Bland <[email protected]>
wrote:
> > > Thanks Alan, I will try changing SECLEVEL=0 to SECLEVEL=1 and let you
> > > know my results.
> >
> >   I've pushed some changes which should help.  They address differences
in the APIs between OpenSSL 1.x and OpenSSL 3.
> >
> >   You'll have to build it from source, but I think now it should work.
> >
> >   Alan DeKok.
> >
>
> Thanks again Alan.  I will test it out and report back.
>
> Best regards,
>
> Dennis

Hi Alan, I was finally able to confirm your EAP-FAST fix for OpenSSL 3.0.x
works with TLS 1.2.  Thanks!  This fix addresses issue 5706:

https://github.com/FreeRADIUS/freeradius-server/issues/5706

Log file is attached, which includes the PAC file creation phase and
expected EAP failure to force a new authentication with the PAC file.  I
also confirmed EAP-PEAP/MSCHAPv2 continues to work.

Best regards,

Dennis Bland

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html