EAP TLS not working

[EARUN]

Hello,
i've installed IAS in an AD2003 infrastructure for wired/wireless 802.1X.
logging with PEAP/MSCHAPV2 works well -ok ( with CA certificate check ).
EAP TLS doesn't.
i've renewed user certificate, check type ( client auth) ...everything seems
to be fine but i get "fired" by IAS .
IAS TLS logs (RASTLS.log) seems to be telling that the certificate used is
the wrong one ...but i'be bee checking that too, doesn't see anything
wrong...What d oi miss ?
hereunder some logs :
[560] 16:52:19:309: EapTlsMakeMessage(caille1\nacuser2)
[560] 16:52:19:309: >> Received Response (Code: 2) packet: Id: 7, Length:
198, Type: 13, TLS blob length: 0. Flags:
[560] 16:52:19:309: EapTlsSMakeMessage
[560] 16:52:19:309: MakeReplyMessage
[560] 16:52:19:309: SecurityContextFunction
[560] 16:52:19:543: AcceptSecurityContext returned 0x0
[560] 16:52:19:543: AuthenticateUser
[560] 16:52:19:543: FGetEKUUsage
[560] 16:52:19:543: FCheckPolicy
[560] 16:52:19:543: CertVerifyCertificateChainPolicy succeeded but policy
check failed 0x800b0112.
[560] 16:52:19:543: FCheckPolicy done.
[560] 16:52:19:543: The user's cert does not have correct usage.
[560] 16:52:19:543: MakeAlert(49, Manual)
[560] 16:52:19:543: State change to SentFinished. Error: 0x800b0112
[560] 16:52:19:543: BuildPacket
[560] 16:52:19:543: << Sending Request (Code: 1) packet: Id: 8, Length: 17,
Type: 13, TLS blob length: 7. Flags: L

It'll be great if you give me any tips !!

Best regards

Eric

[James McIllece [MS]]

Post by EARUN
The user's cert does not have correct usage.

This line indicates that the user certificate does not have the correct
purpose in Enhanced Key Usage (EKU) extensions. Ensure that the User
certificate contains the Client Authentication purpose.

See the IAS Help topic "Network access authentication and certificates" for
information on how to configure the cert with the minimum requirements for
use with EAP-TLS. The topic is also on the Web at
http://technet2.microsoft.com/windowsserver/en/library/9d8b61c9-a870-4627-
a8f2-148625fd7fba1033.mspx

[EARUN]

Hello James !
thanks for your reply....
i've checked my certificate EKU - it is ( client auth certicate)
i've imported a new one on 2 computers, doesn't work ....
EAp-PEAP with server certificate check works ok, not TLS

best regards

Eric - from la Reunion Island

Post by James McIllece [MS]

Post by EARUN
The user's cert does not have correct usage.

This line indicates that the user certificate does not have the correct
purpose in Enhanced Key Usage (EKU) extensions. Ensure that the User
certificate contains the Client Authentication purpose.
See the IAS Help topic "Network access authentication and certificates" for
information on how to configure the cert with the minimum requirements for
use with EAP-TLS. The topic is also on the Web at
http://technet2.microsoft.com/windowsserver/en/library/9d8b61c9-a870-4627-
a8f2-148625fd7fba1033.mspx
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online account
name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

[James McIllece [MS]]

Post by EARUN
Hello James !
thanks for your reply....
i've checked my certificate EKU - it is ( client auth certicate)
i've imported a new one on 2 computers, doesn't work ....
EAp-PEAP with server certificate check works ok, not TLS
best regards
Eric - from la Reunion Island

Post by James McIllece [MS]

Post by EARUN
The user's cert does not have correct usage.

This line indicates that the user certificate does not have the
correct purpose in Enhanced Key Usage (EKU) extensions. Ensure that
the User certificate contains the Client Authentication purpose.
See the IAS Help topic "Network access authentication and
certificates" for information on how to configure the cert with the
minimum requirements for use with EAP-TLS. The topic is also on the
Web at
http://technet2.microsoft.com/windowsserver/en/library/9d8b61c9-a870-4
627- a8f2-148625fd7fba1033.mspx
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online
account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --

Sorry to hear that didn't help out. You said you "imported" a new cert to
other clients -- are you using Certificate Services and Group Policy to
autoenroll certs? If not, what is the method you're using to enroll them to
clients or users?

[EARUN]

Hi james, thanks for your replies !

i use web acces to certificate authoritie server ( http://CAserver/certsrv/)
and go to advanced , so to ask for a client certificate.
Then go to the CA, issue the certificate ( by issue n°),
then back to the client session, and get the certificate ( click, then
auto-install).
Everything goes on without any error messages.
The certicate is in local user/personal/certificates, with the right EKU
(1.3.6.1.5.5.7.3.2)

.... so what's on doc ?

Best regards

Eric

Post by James McIllece [MS]

Post by EARUN
Hello James !
thanks for your reply....
i've checked my certificate EKU - it is ( client auth certicate)
i've imported a new one on 2 computers, doesn't work ....
EAp-PEAP with server certificate check works ok, not TLS
best regards
Eric - from la Reunion Island

Post by James McIllece [MS]

Post by EARUN
The user's cert does not have correct usage.

This line indicates that the user certificate does not have the
correct purpose in Enhanced Key Usage (EKU) extensions. Ensure that
the User certificate contains the Client Authentication purpose.
See the IAS Help topic "Network access authentication and
certificates" for information on how to configure the cert with the
minimum requirements for use with EAP-TLS. The topic is also on the
Web at
http://technet2.microsoft.com/windowsserver/en/library/9d8b61c9-a870-4
627- a8f2-148625fd7fba1033.mspx
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online
account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --
Sorry to hear that didn't help out. You said you "imported" a new cert to
other clients -- are you using Certificate Services and Group Policy to
autoenroll certs? If not, what is the method you're using to enroll them to
clients or users?
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online account
name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

[James McIllece [MS]]

Post by EARUN
Hi james, thanks for your replies !
i use web acces to certificate authoritie server (
http://CAserver/certsrv/) and go to advanced , so to ask for a client
certificate. Then go to the CA, issue the certificate ( by issue n°),
then back to the client session, and get the certificate ( click, then
auto-install).
Everything goes on without any error messages.
The certicate is in local user/personal/certificates, with the right
EKU (1.3.6.1.5.5.7.3.2)
.... so what's on doc ?
Best regards
Eric

Post by James McIllece [MS]

Post by EARUN
Hello James !
thanks for your reply....
i've checked my certificate EKU - it is ( client auth certicate)
i've imported a new one on 2 computers, doesn't work ....
EAp-PEAP with server certificate check works ok, not TLS
best regards
Eric - from la Reunion Island

Post by James McIllece [MS]

Post by EARUN
The user's cert does not have correct usage.

This line indicates that the user certificate does not have the
correct purpose in Enhanced Key Usage (EKU) extensions. Ensure
that the User certificate contains the Client Authentication
purpose.
See the IAS Help topic "Network access authentication and
certificates" for information on how to configure the cert with
the minimum requirements for use with EAP-TLS. The topic is also
on the Web at
http://technet2.microsoft.com/windowsserver/en/library/9d8b61c9-a87
0-4 627- a8f2-148625fd7fba1033.mspx
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my
online account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --
Sorry to hear that didn't help out. You said you "imported" a new
cert to other clients -- are you using Certificate Services and Group
Policy to autoenroll certs? If not, what is the method you're using
to enroll them to clients or users?
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online
account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --

If you can let me know the certificate template you're using for the client
or user certificate that will be helpful.

Also, please send the IAS server and client log files so that they can be
inspected; without those logs it will be pretty hard to determine exactly
what's happening. You can send the logs to ***@nospam.microsoft.com
(just take out the word no spam)

Thanks --

[EARUN]

Hello James,
i use the default client certificate template , as available through web
access.
The enrollment is done connected to the "certsrv" by the same way ( as read
from msoft website...)

i've sent the logs at the mails adress you've sent me...

Best regards

Eric

Post by James McIllece [MS]

Post by EARUN
Hi james, thanks for your replies !
i use web acces to certificate authoritie server (
http://CAserver/certsrv/) and go to advanced , so to ask for a client
certificate. Then go to the CA, issue the certificate ( by issue n°),
then back to the client session, and get the certificate ( click, then
auto-install).
Everything goes on without any error messages.
The certicate is in local user/personal/certificates, with the right
EKU (1.3.6.1.5.5.7.3.2)
.... so what's on doc ?
Best regards
Eric

Post by James McIllece [MS]

Post by EARUN
Hello James !
thanks for your reply....
i've checked my certificate EKU - it is ( client auth certicate)
i've imported a new one on 2 computers, doesn't work ....
EAp-PEAP with server certificate check works ok, not TLS
best regards
Eric - from la Reunion Island

Post by James McIllece [MS]

Post by EARUN
The user's cert does not have correct usage.

This line indicates that the user certificate does not have the
correct purpose in Enhanced Key Usage (EKU) extensions. Ensure
that the User certificate contains the Client Authentication
purpose.
See the IAS Help topic "Network access authentication and
certificates" for information on how to configure the cert with
the minimum requirements for use with EAP-TLS. The topic is also
on the Web at
http://technet2.microsoft.com/windowsserver/en/library/9d8b61c9-a87
0-4 627- a8f2-148625fd7fba1033.mspx
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my
online account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --
Sorry to hear that didn't help out. You said you "imported" a new
cert to other clients -- are you using Certificate Services and Group
Policy to autoenroll certs? If not, what is the method you're using
to enroll them to clients or users?
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online
account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --
If you can let me know the certificate template you're using for the client
or user certificate that will be helpful.
Also, please send the IAS server and client log files so that they can be
inspected; without those logs it will be pretty hard to determine exactly
(just take out the word no spam)
Thanks --
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online account
name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

[James McIllece [MS]]

Post by EARUN
Hello James,
i use the default client certificate template , as available through
web access.
The enrollment is done connected to the "certsrv" by the same way ( as
read from msoft website...)
i've sent the logs at the mails adress you've sent me...
Best regards
Eric

Post by James McIllece [MS]

Post by EARUN
Hi james, thanks for your replies !
i use web acces to certificate authoritie server (
http://CAserver/certsrv/) and go to advanced , so to ask for a
client certificate. Then go to the CA, issue the certificate ( by
issue n°), then back to the client session, and get the
certificate ( click, then auto-install).
Everything goes on without any error messages.
The certicate is in local user/personal/certificates, with the
right EKU (1.3.6.1.5.5.7.3.2)
.... so what's on doc ?
Best regards
Eric

Post by James McIllece [MS]

Post by EARUN
Hello James !
thanks for your reply....
i've checked my certificate EKU - it is ( client auth certicate)
i've imported a new one on 2 computers, doesn't work ....
EAp-PEAP with server certificate check works ok, not TLS
best regards
Eric - from la Reunion Island

Post by James McIllece [MS]

Post by EARUN
The user's cert does not have correct usage.

This line indicates that the user certificate does not have the
correct purpose in Enhanced Key Usage (EKU) extensions. Ensure
that the User certificate contains the Client Authentication
purpose.
See the IAS Help topic "Network access authentication and
certificates" for information on how to configure the cert with
the minimum requirements for use with EAP-TLS. The topic is
also on the Web at
http://technet2.microsoft.com/windowsserver/en/library/9d8b61c9-
a87 0-4 627- a8f2-148625fd7fba1033.mspx
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my
online account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --
Sorry to hear that didn't help out. You said you "imported" a new
cert to other clients -- are you using Certificate Services and
Group Policy to autoenroll certs? If not, what is the method
you're using to enroll them to clients or users?
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my
online account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --
If you can let me know the certificate template you're using for the
client or user certificate that will be helpful.
Also, please send the IAS server and client log files so that they
can be inspected; without those logs it will be pretty hard to
determine exactly what's happening. You can send the logs to
Thanks --
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online
account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Eric --

Thanks for the information and for sending the files.

I haven't reviewed the logs yet but I believe the default cert template
will not work for EAP-TLS without some reconfiguration according to the
requirements outlined in "Network access authentication and certificates."

It has been awhile since I deployed certs using Windows Server 2003, so I
don't recall the exact change you need to make to the cert, but it is
documented. Basically what you need to do is open Certificate Templates,
make a copy of the cert you want to use, and then revise the copy. I am not
sure how you specify in the Web tool which template to use, again my memory
is foggy, but that should either be intuitive, documented, or both.

I am going to forward the logs to the product team for review and will get
back to you when/if we have something to add.

Thanks much --

[James McIllece [MS]]

snip<

Post by James McIllece [MS]
Hi Eric --
If you can let me know the certificate template you're using for the
client or user certificate that will be helpful.
Also, please send the IAS server and client log files so that they
can be inspected; without those logs it will be pretty hard to
determine exactly what's happening. You can send the logs to
Thanks --
--

Hi Eric --

I just checked that email account and the log files haven't arrived -- sure
you got the email address correct? Make sure you remove the "nospam" from
the address. :-)

Thanks --

[EARUN]

Hello James ,
thanks for your quick reply ( as usual!).
i'm gonna check the certicate template !
Too, i gonna buy some more brain at the market, so as not to forget simples
things :
i didn't clear nospam in the email address ( cop+paste)
That's done now

best regards

Eric

Post by James McIllece [MS]

snip<

Post by James McIllece [MS]
Hi Eric --
If you can let me know the certificate template you're using for the
client or user certificate that will be helpful.
Also, please send the IAS server and client log files so that they
can be inspected; without those logs it will be pretty hard to
determine exactly what's happening. You can send the logs to
Thanks --
--

Hi Eric --
I just checked that email account and the log files haven't arrived -- sure
you got the email address correct? Make sure you remove the "nospam" from
the address. :-)
Thanks --
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online account
name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

[James McIllece [MS]]

You're welcome, Eric, and thanks for sending the logs. A knowledgeable
member of the IAS/NPS team has reviewed the logs and here is his
conclusion:


****Begin quote*****

"The MakeAlert(49, Manual) is not the actual error, but rather the Error:
0x800b0112. This error translates to

# for hex 0x800b0112 / decimal -2146762478
CERT_E_UNTRUSTEDCA winerror.h
# A certification chain processed correctly, but one of the
# CA certificates is not trusted by the policy provider.
# 1 matches found for "0x800b0112"

So from the logs, I can tell the following things:

The client does send his certificate, the IAS server is rejecting it
because it does not trust the issuing CA of the client's cert. Are the
client certificates issued by the same CA that issued the IAS server it's
certificate? Are these certificates issued by a Microsoft CA or are they
from a 3rd party CA?

Beyond this, I would suggest that he open a support case. Without
detailed troubleshooting, it's going to be hard to determine what is wrong
with his configuration. To move forward, we would need copies of the certs
on the IAS and client as well as possibly getting netmon traces.
"
*****End quote****

So the question is whether your IAS server trusts the CA that issued the
client computer certificate.

This can get confusing, so here are the 3 types of certs in use when you
deploy EAP-TLS:

-- CA cert -- this cert must be in the Trusted Root Certification
Authorities (TRCA) certificate store in order for a client computer or
server to trust other certificates that the CA issues. After you deploy an
Enterprise CA, this cert is automatically issued to all domain member
computers. (But not to non-domain member computers.)
-- IAS server cert -- issued by the CA mentioned above to the IAS server
-- Client computer cert -- issued by the CA above to client computers

So the CA that issues both the server cert and the client certs must be the
same, and both the clients and the server must have the CA cert in the TRCA
stores for both the Local Computer and Current User.

If your IAS server is a non-domain member, you must manually install the CA
cert in the TRCA store.

In other words, to trust the issuing CA, all non-domain member computers
must have the cert installed in the TRCA stores for the Local Computer and
Current User;

You can install the cert by opening the Certificates Microsoft Management
Console (MMC) on any domain member computer, browsing to the TRCA store,
and exporting the certificate to floppy, USB flash drive, etc; then on the
non-domain member computer (client or server), you can open the
Certificates MMC (add both Local Computer and Current User stores to the
snap-in) and import the cert to the TRCA store.

Note: Don't try to drag and drop the cert between folders in the
Certificates snap-in or the key is broken and it won't work. You must use
Import and Export to move a certificate.

Hopefully this helps you, but if not I agree with my team member that you
should open a support case with customer support services.

Thanks, and let me know how it goes --

James

Post by EARUN
Hello James ,
thanks for your quick reply ( as usual!).
i'm gonna check the certicate template !
Too, i gonna buy some more brain at the market, so as not to forget
i didn't clear nospam in the email address ( cop+paste)
That's done now
best regards
Eric

Post by James McIllece [MS]

snip<

Post by James McIllece [MS]
Hi Eric --
If you can let me know the certificate template you're using for
the client or user certificate that will be helpful.
Also, please send the IAS server and client log files so that they
can be inspected; without those logs it will be pretty hard to
determine exactly what's happening. You can send the logs to
Thanks --
--

Hi Eric --
I just checked that email account and the log files haven't arrived
-- sure you got the email address correct? Make sure you remove the
"nospam" from the address. :-)
Thanks --
--
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online
account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.