Re: No full certificate chain in EAP in 3.2.7

--===============8478913905192436053==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_2232A623-49E6-4B3E-B593-D7B81979B4CA";
	protocol="application/pgp-signature";
	micalg=pgp-sha256


--Apple-Mail=_2232A623-49E6-4B3E-B593-D7B81979B4CA
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On Jun 29, 2026, at 7:56=E2=80=AFPM, Dave Wang <[email protected]> =
wrote:
> Recently I upgraded from freeradius 3.0.26 (with openssl 3.0.20) to
> 3.2.7/3.2.8,

  Why not use 3.2.10?

> (with openssl 3.5.0), and I noticed that the server does not
> send the full certificate chain to the EAP client anymore.
>=20
> The server certificate has a chained structure like cert->intermediate
> CA2->intermediate CA1->root CA, and I am relying on the auto_chain and =
the
> ca_path to construct the chain on the freeradius side.
>=20
> Now it only sends the server_certificate + intermediate CA2, but =
previously
> it sent all *four* certificates. Is this a known issue?

  No, but it might be related to differing OpenSSL behavior.

  Disable auto_chain, and create the chains manually.  As the comments =
for auto_chain say, sometimes OpenSSL gets it wrong.

  Alan DeKok.


--Apple-Mail=_2232A623-49E6-4B3E-B593-D7B81979B4CA
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmpDtQwACgkQv3SJ0h7d
TTPCYg//ctF63kdnRu5d8HQyYCDVi7Y/gUW+SmpGAy4VRe+dPbEOyZNvM9KuTeSS
UTUAUrFDH/ESzrDVZeQMwdRjHFOZw7sTmz6ZCSPe6++ygb7odLM6ZfZvX107JX9n
7LB6jB+Lw5ZoOFga1fH1AcsCIuxupTbff3OD6Yt0liokMZYCxZhRhxeQTwqUmO5y
VljZyr0hG1IerxX+Ad8LRNhTTNHg6+mS5p2+XRn9sWzPP/W3aTI/he63ugxhDtaU
MEIzeSIVcjUjVq5VGcfq1Fv1/oa+2VmNszyeuM1vRapXt02QqWw5dnWkaLcveayW
r4sKODLlRRkQiHdhwKK+f+jYamxUBBL1MJYH1tQvcAyigIWsbxFSgeLEDCoSg/tk
1fxkz4elVJUyQz1/SV7tmDvvqfGNasXa6/BXZx5j/2a7Jou+FBzybxmejkWknarA
4eYw8zXmGnlx8BexTxFGyhQvUq498cF+zkdBgi9yjw500mn6EEOwx5hddAi9N4G6
fWkh7VQiz3PF+oBytmjs0qxL60w4qfUxXJ0MXa+dcuuV+yV+ZhH67jXAdTzGwX9W
sFI+gLS6ENwzZQQFyoH6j++tnEVx4ZR+HyTlMhb/RiIP2+5Nj8+w4TeSj7DxSyag
J0mTDfPb78Mfoaw0HtvajPuOPMEi+/LrGPL+znkssCCUPnixwJU=
=Z2dx
-----END PGP SIGNATURE-----

--Apple-Mail=_2232A623-49E6-4B3E-B593-D7B81979B4CA--

--===============8478913905192436053==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--===============8478913905192436053==--