Re: FreeRADIUS RHEL 10 Upgrade – Older Client TLS Compatibility Question

--===============7214295934447046286==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_835223E0-D132-4D71-8D50-8DEEA82FBFF4";
	protocol="application/pgp-signature";
	micalg=pgp-sha256


--Apple-Mail=_835223E0-D132-4D71-8D50-8DEEA82FBFF4
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On Jul 20, 2026, at 4:09=E2=80=AFPM, Mike Diggins <[email protected]> =
wrote:
>=20
> I'm updating my FreeRADIUS environment to RHEL 10 using the =
RHEL-provided FreeRADIUS 3.2.8 package and the default OpenSSL version =
(3.5.5). For the most part, everything is working as it did before, but =
I have one admittedly very old MacBook Air running Sierra 10.12.6 that =
no longer works in the new environment. FreeRADIUS is reporting SSL/TLS =
errors.
>=20
> Long story short, I found I could get it working by lowering what =
appear to be some of the new minimum SSL/TLS requirements:
>=20
> OS: update-crypto-policies --set LEGACY
> FreeRADIUS: tls_min_version =3D "1.0"
> FreeRADIUS: cipher_list =3D "DEFAULT@SECLEVEL=3D0"

  It's best to avoid TLS 1.0.

> I had to drop it all the way back to TLS 1.0 for this client to work. =
While researching, I noticed that even this older version of macOS =
should (?) support TLS 1.2, so I'm trying to understand why it no longer =
works. My previous FreeRADIUS server was running on RHEL 7 with =
FreeRadius 3.0.13 and OpenSSL 1.0.2.

  Ask the old MacBook Air why it's not accepting TLS 1.2.  FreeRADIUS =
isn't forcing you to use TLS 1.0, the MacBook is choosing it.

  If you run FreeRADIUS in debug mode, you will see what the MacBook is =
sending.  This information will include any TLS mismatch, complaints, =
etc.

  i.e. as *all* of the documentation suggests, if you want to see what's =
going on, run it in debug mode and read the output.  99% of the time, =
the information you want to know is in the debug output.

> I'm also wondering what kind of security impact there would be if I =
left these settings in place. We are a large BYOD environment with many =
different types of clients, and I don't know how many other devices may =
have similar compatibility issues.

  TLS 1.0 is "fine", for various insecure definitions of "fine".  It =
will work, and you _likely_ won't be attacked.

  But if TLS 1.2 is out, there are no reasons to use TLS 1.0.  Use TLS =
1.2, it's the best security available.

  Alan DeKok.


--Apple-Mail=_835223E0-D132-4D71-8D50-8DEEA82FBFF4
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmpeSBUACgkQv3SJ0h7d
TTM3nA/+MiziNzzLzePMhG7Umb1XWltwlNz3pCtTWEkkYcEsZRvJeM/tQlaby0L4
KtaPiyAXieETSRnoPsQih68JbbUjpBgULdqNhqvNpqDPtGzXWjYVKQ4ToUZvrbCL
gns54qbOYhkaVTm+GpnyEHqqt+s1szOkSEU3z7cD7ppieyiLHspYU+xT9Xv7PkYi
xhlQLMw2RY3k5Y4WpN8KtShwQlpLUJ4oLe4gEawW0E3+SyzMo7xxvlCdhsYVMC+5
VkTCpcbKYYEAcrBcbIpaP2fB9+Y5aWNc5Nwg3tvYGtO7ElKJhp9Z+i497LBha4Mp
QUiFMDREJA1Xh8hRtXZ1rhGyzV9UCmTxDQYk5qoMu5aSBgIEZQtWGo/BJ3bW7zqG
Zd/QKZ2KH6J+TYtmewCglGQtFDzEuXGlJTxxwXpl/05mNTOJkRd2uK/M4qxs0ao+
tO/u6KOVu0+SVXqZURVZj7gb0ZB2btBbF5KVOZQgkR4ksmHlccNkqIPh9404q74L
nDyms1P34rWjoa7xF5VVl7sjYuny25KPvijt11vdDpr3aBMKJxbvj48jOMFQkumC
TICoHWEKGq29nsDEjCktNchaUNvDtV9SePJjhgujsSHDpmqvet/MlJoqlNa81gPk
QQIqJynlGTpdfQkf3+ydMcozG48ysR9SarB3/aOfXr9SYE+Eps4=
=qqe4
-----END PGP SIGNATURE-----

--Apple-Mail=_835223E0-D132-4D71-8D50-8DEEA82FBFF4--

--===============7214295934447046286==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
--===============7214295934447046286==--