FreeRADIUS 3.2.8 EAP-TLS OCSP fails with AWS Private CA: signer certificate not found

Hi all,

We are investigating an OCSP validation issue with FreeRADIUS 3.2.8 and AWS ACM Private CA managed OCSP.

EAP-TLS certificate validation works when native OCSP is disabled. When native OCSP is enabled, authentication fails during the OCSP check with:

(11) eap_tls: Starting OCSP Request
(11) eap_tls: ocsp: Using responder URL "http://ocsp.acm-pca.eu-west-2.amazonaws.com:80/"
(11) eap_tls: ERROR: (TLS) ocsp: Couldn't verify OCSP basic response: error:13800076:OCSP routines::signer certificate not found
(11) eap_tls: ERROR: (TLS) ocsp: Certificate has been expired/revoked
(11) eap_tls: ERROR: (TLS) Failed reading from OpenSSL: error:0A000086:SSL routines::certificate verify failed
(11) Sent Access-Reject

Environment:

FreeRADIUS: 3.2.8
OS/container: Alpine 3.23
TLS: EAP-TLS via rlm_eap
OCSP responder: AWS ACM Private CA managed OCSP
OCSP nonce: disabled, as AWS Private CA managed OCSP does not support request extensions

The relevant section from EAP TLS configuration is:

    verify {
      tmpdir = /tmp/radiusd
      client = "/usr/bin/openssl verify -verbose -CAfile ${certdir}/ca-bundle.pem -CApath ${certdir} %{TLS-Client-Cert-Filename}"
    }

    ocsp {
      enable = yes
      override_cert_url = no
      use_nonce = no
    }
  }



The OCSP response from AWS contains:

OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
Responder Id: C = GB, O = xxxxxx, OU = NACS, CN = xxxxxxxxxxxxxx-20260701113446
Cert Status: good
This Update: Aug 11 10:18:25 2026 GMT
Next Update: Aug 18 09:18:25 2026 GMT
Signature Algorithm: sha256WithRSAEncryption

We do not see an embedded responder certificate in the OCSP response output. The responder ID appears to match the issuing CA.

Standalone OpenSSL tests inside the same container succeed.

Command without -verify_other:

openssl ocsp \
  -issuer issuing-ca.pem \
  -cert ocsp-test-client.pem \
  -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \
  -CAfile root-ca.pem \
  -no_nonce \
  -resp_text

Result:

Response verify OK
ocsp-test-client.pem: good

Command with -verify_other:

openssl ocsp \
  -issuer issuing-ca.pem \
  -cert ocsp-test-client.pem \
  -url "http://ocsp.acm-pca.eu-west-2.amazonaws.com" \
  -CAfile root-ca.pem \
  -verify_other issuing-ca.pem \
  -no_nonce \
  -resp_text

Result:

Response verify OK
ocsp-test-client.pem: good

We have also tested EAP-TLS with the supplicant sending:

1. leaf certificate + issuing CA
2. leaf certificate only

Both cases fail in FreeRADIUS native OCSP with the same error:

OCSP routines::signer certificate not found

We have also tested adding root + issuing CA to ca-bundle.pem, configuring both ca_file and ca_path, and running openssl rehash on the certificate directories before FreeRADIUS starts. That did not change the FreeRADIUS native OCSP result.

So the current state is:

- AWS OCSP endpoint is reachable from the container
- AWS returns Cert Status: good
- standalone OpenSSL ocsp verification succeeds inside the same container
- FreeRADIUS native OCSP fails during EAP-TLS with signer certificate not found
- the failure occurs even when the issuing CA is in ca_file/ca_path
- the failure occurs whether the client sends leaf+issuer or leaf only

I found this earlier mailing-list thread which looks similar:

https://lists.freeradius.org/hyperkitty/list/[email protected]/message/YQ2KDIMYXLCBGXCG4ICLZCMO4AJUTAVN/

In that thread, the discussion mentions responder certificate purpose / OCSPSigning. In our case the AWS response responder ID appears to be the issuing CA itself, and standalone OpenSSL verifies the response successfully.

My question is: what additional certificate/context does FreeRADIUS 3.2.8 need for native OCSP verification here, given that the same OCSP response verifies successfully with standalone OpenSSL in the same container?

Is there any additional debug output or specific certificate inspection that would help confirm why FreeRADIUS cannot locate the OCSP response signer?

Thanks,
Andrew
- 
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html