certificate expired

最近在测试802.1x，测试过程中，radius服务器端一直显示如下错误：

(5)   authenticate {
(5) eap: Expiring EAP session with state 0x3990473e3d795e62
(5) eap: Finished EAP session with state 0x3990473e3d795e62
(5) eap: Previous EAP request found for state 0x3990473e3d795e62, released from the list
(5) eap: Peer sent packet with method EAP PEAP (25)
(5) eap: Calling submodule eap_peap to process data
(5) eap_peap: Continuing EAP-TLS
(5) eap_peap: Peer indicated complete TLS record size will be 7 bytes
(5) eap_peap: Got complete TLS record (7 bytes)
(5) eap_peap: [eaptls verify] = length included
(5) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal certificate_expired
(5) eap_peap: ERROR: TLS Alert read:fatal:certificate expired
(5) eap_peap: ERROR: TLS_accept: Failed in unknown state
(5) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read)
(5) eap_peap: ERROR: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired
(5) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure
(5) eap_peap: ERROR: System call (I/O) error (-1)
(5) eap_peap: ERROR: TLS receive handshake failed during operation
(5) eap_peap: ERROR: [eaptls process] = fail
(5) eap: ERROR: Failed continuing EAP PEAP (25) session.  EAP sub-module failed
(5) eap: Sending EAP Failure (code 4) ID 233 length 4
(5) eap: Failed in EAP select
(5)     [eap] = invalid
(5)   } # authenticate = invalid

主要错误显示 证书过期。

在AP侧抓包得到，client在 验证服务器证书时过期，报文如下：

因此，进入了一个误区，错误的认为 服务器编译出来的证书有误（有效期），更正freeradius产生的有效期为10年。client仍然报此错误。

后查看client端的 wpa_supplicant部分代码，得到

if (!disable_time_checks &&
      ((unsigned long) now.sec <
       (unsigned long) cert->not_before ||
       (unsigned long) now.sec >
       (unsigned long) cert->not_after)) {
   wpa_printf(MSG_INFO, "X509: Certificate not valid "
       "(now=%lu not_before=%lu not_after=%lu)",
       now.sec, cert->not_before, cert->not_after);
   *reason = X509_VALIDATE_CERTIFICATE_EXPIRED;
   return -1;
  }

证书有效时间的对比是要跟 设备的当前时间进行对比的。

查看设备的当前时间，在证书有效期之前，所以产生了此错误。