topic Re: PEAP set up in Wireless https://community.cisco.com/t5/wireless/peap-set-up/m-p/813767#M25742 <HTML><HEAD></HEAD><BODY><P>Hi</P><P></P><P>I got the same problem (ACS 4.1) </P><P>Unchecking validate server cert makes it working.</P><P>But this way clients will accept any server certificate, i.e. man in the middle will be possible !</P><P>Is there a way to solve the probleme ?</P><P></P></BODY></HTML> Wed, 22 Aug 2007 08:21:41 GMT e.wahl 2007-08-22T08:21:41Z PEAP set up https://community.cisco.com/t5/wireless/peap-set-up/m-p/813765#M25740 <P>Does anybody have experience setting up PEAR with ACS in Windows environment? I really got headache.</P><P>I used CA services in Windows issue 2 user certificates to a user account and a computer (XP with SP2). Then I issued a certificate to ACS. I also installed the CA root to ACS. I think I did everything following Cisco document. However, I got "EAP-TLS or PEAP authentication failed during SSL handshake"</P><P>in failed attempts log and </P><P>"PEAP: ProcessResponse: SSL handshake failed, status = 3 (SSL alert fatal:certificate unknown)"in CSAuth logs.</P><P></P><P>Have worked on this issue for 2 weeks but no clue at all. Please help me out.</P> Sat, 03 Jul 2021 21:30:46 GMT https://community.cisco.com/t5/wireless/peap-set-up/m-p/813765#M25740 sky_zhang 2021-07-03T21:30:46Z Re: PEAP set up https://community.cisco.com/t5/wireless/peap-set-up/m-p/813766#M25741 <HTML><HEAD></HEAD><BODY><P>Sky,</P><P>SSL handshake points out to certificate issue. Please uncheck validate server cert on suplicant and then try to connect.</P><P></P><P>Find attached the peap guide</P><P></P><P></P><P>Regards,</P><P>JG</P><P></P><P> </P><P></P></BODY></HTML> Tue, 21 Aug 2007 14:47:50 GMT https://community.cisco.com/t5/wireless/peap-set-up/m-p/813766#M25741 Jagdeep Gambhir 2007-08-21T14:47:50Z Re: PEAP set up https://community.cisco.com/t5/wireless/peap-set-up/m-p/813767#M25742 <HTML><HEAD></HEAD><BODY><P>Hi</P><P></P><P>I got the same problem (ACS 4.1) </P><P>Unchecking validate server cert makes it working.</P><P>But this way clients will accept any server certificate, i.e. man in the middle will be possible !</P><P>Is there a way to solve the probleme ?</P><P></P></BODY></HTML> Wed, 22 Aug 2007 08:21:41 GMT https://community.cisco.com/t5/wireless/peap-set-up/m-p/813767#M25742 e.wahl 2007-08-22T08:21:41Z Re: PEAP set up https://community.cisco.com/t5/wireless/peap-set-up/m-p/813768#M25743 <HTML><HEAD></HEAD><BODY><P>I don?t think MIM is possible. Even if you do not check validate server certificate. In PEAP, still supplicant uses the certificate offered by Server as to create an SSL tunnel.</P><P></P><P>Validating server certificate is just an additional security, where you ensure that you are connecting to correct Radius server, if you have many in your network...</P><P></P><P>Regards,</P><P>Prem</P></BODY></HTML> Wed, 22 Aug 2007 11:22:03 GMT https://community.cisco.com/t5/wireless/peap-set-up/m-p/813768#M25743 Premdeep Banga 2007-08-22T11:22:03Z Re: PEAP set up https://community.cisco.com/t5/wireless/peap-set-up/m-p/813769#M25744 <HTML><HEAD></HEAD><BODY><P>And to get correct the SSL handshake,</P><P></P><P>Ensure that we have *also* installed the root certificate, from "ACS Certification Authority Setup" and checked that root certificate from where ACS's server certificate was issued in "Edit Certificate Trust List"</P><P></P><P>Regards,</P><P>Prem</P></BODY></HTML> Wed, 22 Aug 2007 11:25:40 GMT https://community.cisco.com/t5/wireless/peap-set-up/m-p/813769#M25744 Premdeep Banga 2007-08-22T11:25:40Z Re: PEAP set up https://community.cisco.com/t5/wireless/peap-set-up/m-p/813770#M25745 <HTML><HEAD></HEAD><BODY><P>Thanks man!</P></BODY></HTML> Thu, 23 Aug 2007 17:35:08 GMT https://community.cisco.com/t5/wireless/peap-set-up/m-p/813770#M25745 sky_zhang 2007-08-23T17:35:08Z