How to Generate FreeRADIUS Client and Server Certificates

Last updated
Save as PDF

Overview

WPA2-Enterprise with 802.1X authentication uses certificates so the client and the RADIUS server can verify each other's identity and perform mutual authentication. To do this, you need three certificates:

A Certificate Authority (CA) certificate that signs and validates the other certificates.

A server certificate that the RADIUS server presents to clients.

A client certificate that each client presents to the RADIUS server.

This article explains how to generate all three certificates on a FreeRADIUS server using the OpenVPN package and its bundled easy-rsa toolkit. Once generated, move the certificates into the FreeRADIUS certificate directory to replace the default test certificates.

Prerequisites

FreeRADIUS already installed on the server. Installing FreeRADIUS creates the /etc/freeradius/certs/ directory and a default set of test certificates that you will replace.

A server running Ubuntu Server 12.04.2. The file paths and commands in this article match this version.

Ability to run every command in this guide either as the root user or with sudo. The source ./vars and ./pkitool commands in particular must be run as root so the easy-rsa environment variables load correctly.

Step-by-step instructions

Install OpenVPN and copy the easy-rsa toolkit

The easy-rsa toolkit ships with the OpenVPN package. You install OpenVPN only to get easy-rsa; you do not need to configure or run a VPN.

Install OpenVPN:
sudo apt-get install openvpn

Create the working directory where you will run the certificate commands:
sudo mkdir /etc/OpenVPN/easy-rsa

Copy the easy-rsa files into the OpenVPN directory:
sudo cp /usr/share/doc/OpenVPN/examples/easy-rsa/2.0/* /etc/OpenVPN/easy-rsa/

Move into the working directory. Run all remaining certificate commands from here:
cd /etc/OpenVPN/easy-rsa

Edit the vars file with your organization's details

The vars file holds the default values (country, organization, email, and so on) that easy-rsa uses when it generates certificates. Editing it once means you do not have to retype these values every time you create a certificate.

Open the vars file in a text editor and update the organization values (such as KEY_CN, KEY_NAME, and KEY_OU)) to match your organization. Save and close the file.

example of a Vars file with the comments and empty lines removed

The example image shows the vars file with comments and empty lines removed for readability. Three of the default comment lines have been commented out.

Generate the CA, server, and client certificates

Load the variables from the vars file into your shell session:
source ./vars
Clear out any existing keys and certificates from previous runs:
./clean-all

./clean-all deletes everything in /etc/openvpn/easy-rsa/keys/. Run it only on a fresh setup or when you intentionally want to start over.

Create the CA certificate. This is the root certificate that signs the server and client certificates:
./pkitool --initca
Create the RADIUS server certificate named radius:
./pkitool --server radius
Create the client certificate in PKCS#12 format. easy-rsa prompts you for a password — record it, because you will need it later when you install the certificate on the client device:
./pkitool --pkcs12 client
Locate the generated files in the /etc/openvpn/easy-rsa/keys/ directory:

ca.crt — the CA certificate
radius.crt — the RADIUS server certificate
radius.key — the RADIUS server private key
client.p12 — the client certificate bundle (install this on the client device)

Replace the default FreeRADIUS test certificates

FreeRADIUS installs a set of self-signed test certificates in /etc/freeradius/certs/. You must remove those test files and replace them with the newly-generated certificates.

Navigate to the FreeRADIUS certificates directory:
cd /etc/freeradius/certs
Remove the default test certificates:
sudo rm ca.pem server.key server.pem
Copy the new CA, server certificate, and server private key into the FreeRADIUS certificates directory:

sudo cp /etc/openvpn/easy-rsa/keys/ca.crt /etc/freeradius/certs/ca.crt
sudo cp /etc/openvpn/easy-rsa/keys/radius.crt /etc/freeradius/certs/radius.crt
sudo cp /etc/openvpn/easy-rsa/keys/radius.key /etc/freeradius/certs/radius.key

Troubleshooting

1. Missing openssl.cnf error.

If a ./pkitool command fails with No /etc/openvpn/easy-rsa/openssl.cnf: file could not be found, run cp openssl-1.0.0.cnf openssl.cnf from inside /etc/openvpn/easy-rsa and rerun the command.

2. Variables not loading.

If ./pkitool does not pick up the values from vars, confirm you ran source./vars in the same shell session and as root. Opening a new terminal window clears the loaded variables, so you must run source./vars again.