Obtaining Certificates

802.1X Port-Based Authentication HOWTO
Prev |  | Next

# 2. Obtaining Certificates

| OpenSSL must be installed to use either EAP-TLS, EAP-TTLS, or PEAP!

When using EAP-TLS, both the Authentication Server and all the Supplicants (clients) need certificates [RFC2459] . Using EAP-TTLS or PEAP, only the Authentication Server requires certificates; Supplicant certificates are optional.

You get certificates from the local certificate authority (CA). If there is no local CA available, OpenSSL may be used to generate self-signed certificates.

Included with the FreeRADIUS source are some helper scripts to generate self-signed certificates. The scripts are located under the `scripts/` folder included with the FreeRADIUS source:

`CA.all` is a shell script that generates certificates based on some questions it ask. `CA.certs` generates certificates non-interactively based on pre-defined information at the start of the script.

| The scripts uses a Perl script called `CA.pl`, included with OpenSSL. The path to this Perl script in `CA.all` and `CA.certs` may need to be changed to make it work.

| More information on how to generate your own certificates can be found in the SSL certificates HOWTO.

Prev | Home | Next
Introduction |  | Authentication Server: Setting up FreeRADIUS