Skip to content

Menu AuthGuardHelp centre

Troubleshooting · VPN and Wi-Fi (RADIUS)

RadSec certificate problems (TLS)

2 min read
SaaS · Self-hosted

Symptom

A device set up with «RadSec (TLS)» cannot authenticate: the TLS connection to port 2083 is refused or closes at once, or requests get no answer.

How does RadSec work here?

The connection uses TLS with a mandatory client certificate. There is no session resumption: each connection proves the certificate afresh.
The device's certificate must be issued by an authority the service trusts, and must not be revoked.
The device is identified by the SHA-256 of its certificate, registered in «Certificate SHA-256».
Inside the tunnel, the shared secret is normally radsec and Message-Authenticator is still required.

Causes and fixes

Cause	What to do
The registered SHA-256 is not the current certificate's (renewed or replaced)	Compute the SHA-256 of the certificate in use and update the client
The certificate does not come from an authority the service accepts	Ask your provider for the accepted authorities, or ask them to add yours
The certificate is revoked or expired	Issue a new certificate and register the new SHA-256
The device does not trust the server's certificate	Install on the device the chain your provider gives you
The device only speaks TLS 1.2	Update the firmware, or ask your provider to allow TLS 1.2
Wrong time on the device	Turn on NTP; certificates depend on time
Too many simultaneous connections	Reduce the device's parallel connections

How do I compute the SHA-256?

With the certificate as a PEM file: openssl x509 -in client.pem -noout -fingerprint -sha256. The form takes 64 hexadecimal characters: remove the colons and the SHA256 Fingerprint= prefix (upper case is converted).

When to escalate

If the certificate, the chain and the SHA-256 are right and the connection still fails, send support the time, the device's address and the SHA-256 (never the private key).

Error codes in this article

Article referencets-radsec-tlsquote it to support to identify this article. Checked against the product at commit 5f6607a8.