Hi Linus ,

Thanks a-lot for your reply. I retried it after setting `certificateNameCheck off' in Server block. However, it is still using mutual authentication (I am copying the packet transfer between Client and Server below). The main difference which I could see was that now it can establish TLS connection with non-matching CN name also.

To turn off mutual authentication i.e. Server should not ask for Client certificate in Server Hello message.  Is there any way to disable "SSL_VERIFY_PEER" in Server code ?

Source                      Destination           Protocol        Info 192.168.1.100        192.168.1.2           TLSv1.2      Client Hello 192.168.1.2            192.168.1.100       TLSv1.2      Server Hello 192.168.1.2            192.168.1.100       TLSv1.2      Certificate <======= Server Certificate 192.168.1.100       192.168.1.2            TLSv1.2      Certificate <======= Client Certificate 192.168.1.2           192.168.1.100        TLSv1.2      New Session Ticket, Change Cipher Spec, Encrypted Handshake Message

Regards, Mofassir

On Wednesday, 5 October 2016 7:58 PM, Linus Nordberg linus@nordu.net wrote:

Mofassir Ul Haque mofassir_haque@yahoo.com wrote Wed, 5 Oct 2016 00:19:55 +0000 (UTC):

Currently, radsecproxy supports mutual authentication by default i.e. both the Client and the Server certificate are validated at the time of TLS connection establishment. However, I want to only validate Server’s certificate.  Is it possible to make changes to TLS Block (radsecproxy.conf) or to code to only do the validation of Server certificate's ? Any help will be greatly appreciated ! Thanks,

You can set `certificateNameCheck off' in a server block to disable verification of client CN and SAN.

Hi Linus,

I have to meet accreditation requirements and evaluators go by the book in-spite of the fact that mutual authentication is much better then normal authentication. Syslog over TLS provides an option in configuration file to use either of them. I was wondering if RFC6614 became a standard or not as currently it is an experimental RFC. Once again thanks alot for your help.

Regards, Mofassir

On Friday, 7 October 2016 12:15 AM, Linus Nordberg linus@nordu.net wrote:

Hi Mofassir,

Ah. I misunderstood your question.

No, there is no way to disable mutual TLS authentication since that would be a bad idea from a security point of view and also violate the standard (see RFC6614 section 2.3). (Thinking of it, one could probably argue that disabling CN/SAN verification is a violation of the standard too.)

Out of curiosity, what is your use case?

Mofassir Ul Haque mofassir_haque@yahoo.com wrote Wed, 5 Oct 2016 22:56:20 +0000 (UTC):

Hi Linus ,

Thanks a-lot for your reply. I retried it after setting `certificateNameCheck off' in Server block. However, it is still using mutual authentication (I am copying the packet transfer between Client and Server below). The main difference which I could see was that now it can establish TLS connection with non-matching CN name also.

To turn off mutual authentication i.e. Server should not ask for Client certificate in Server Hello message.  Is there any way to disable "SSL_VERIFY_PEER" in Server code ?

Source                      Destination           Protocol        Info 192.168.1.100        192.168.1.2           TLSv1.2      Client Hello 192.168.1.2            192.168.1.100       TLSv1.2      Server Hello 192.168.1.2            192.168.1.100       TLSv1.2      Certificate <======= Server Certificate 192.168.1.100       192.168.1.2            TLSv1.2      Certificate <======= Client Certificate 192.168.1.2           192.168.1.100        TLSv1.2      New Session Ticket, Change Cipher Spec, Encrypted Handshake Message

Regards, Mofassir

On Wednesday, 5 October 2016 7:58 PM, Linus Nordberg linus@nordu.net wrote:

Mofassir Ul Haque mofassir_haque@yahoo.com wrote Wed, 5 Oct 2016 00:19:55 +0000 (UTC):

...

Currently, radsecproxy supports mutual authentication by default i.e. both the Client and the Server certificate are validated at the time of TLS connection establishment. However, I want to only validate Server’s certificate.  Is it possible to make changes to TLS Block (radsecproxy.conf) or to code to only do the validation of Server certificate's ? Any help will be greatly appreciated ! Thanks,

You can set `certificateNameCheck off' in a server block to disable verification of client CN and SAN.