Security

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

Hi

In the certificates do you have the same format of the common name and SAN on the machines working and not working?

In your AD source what is the query to find to computer account?

Can you from the Access Tracker dialogue click the button Show Logs and paste the log

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

fatal alert by client - access_denied; suggests that the client has an issue with what ClearPass sends. So that may be the EAP certificate, or the SAN(s) not matching the RADIUS Server name that you configured for the client. It might also be that the client certificate is locked (password), or not present. Maybe you can find something in the Event Viewer on your client?

Clock (time) is set correctly on all of your clients?

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

Since this is a machine certificate, why would it work from majority of the machine and just only a few.  The time is correct and we made sure it is sync correctly.  I compare pretty much everything from the working machine and also import the same cert from the clearpass server but no luck.

Original Message:
Sent: Aug 19, 2024 08:44 AM
From: Herman Robers
Subject: eap-tls: Error in establishing TLS session

fatal alert by client - access_denied; suggests that the client has an issue with what ClearPass sends. So that may be the EAP certificate, or the SAN(s) not matching the RADIUS Server name that you configured for the client. It might also be that the client certificate is locked (password), or not present. Maybe you can find something in the Event Viewer on your client?

Clock (time) is set correctly on all of your clients?

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Aug 17, 2024 08:14 PM
From: johnisccp
Subject: eap-tls: Error in establishing TLS session

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

Assuming you are using ClearPass 6.11.x or newer, by default there is a new TLS encryoption enabled that does not work with come earlier TPM chips.

IMO the best solution is to disable it for every server in the cluster.

Administration -> Server configuration -> [CPPM node] -> Service parameters ->Radius server -> TLS -> Disable RSA-PSS signature Suite in EAP-TLS

Set from FALSE to TRUE

Save for each node in the cluster.

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

Thanks bosborne.  After following your steps, that resolve the issue.  We have machines running TPM 2.0 subversion 1.16.  It looks like clearpass 6.11.8 doesnt support 1.16 subversion so most likely TPM needs to upgrade if possible.  

Assuming you are using ClearPass 6.11.x or newer, by default there is a new TLS encryoption enabled that does not work with come earlier TPM chips.

IMO the best solution is to disable it for every server in the cluster.

Administration -> Server configuration -> [CPPM node] -> Service parameters ->Radius server -> TLS -> Disable RSA-PSS signature Suite in EAP-TLS

Set from FALSE to TRUE

Save for each node in the cluster.

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

Assuming you are using ClearPass 6.11.x or newer, by default there is a new TLS encryoption enabled that does not work with come earlier TPM chips.

IMO the best solution is to disable it for every server in the cluster.

Administration -> Server configuration -> [CPPM node] -> Service parameters ->Radius server -> TLS -> Disable RSA-PSS signature Suite in EAP-TLS

Set from FALSE to TRUE

Save for each node in the cluster.

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

Hi bosborne, 

I'm not able to find this settings in my 6.11.1 cluster - do you mind sharing a screenshot? 

thanks

Assuming you are using ClearPass 6.11.x or newer, by default there is a new TLS encryoption enabled that does not work with come earlier TPM chips.

IMO the best solution is to disable it for every server in the cluster.

Administration -> Server configuration -> [CPPM node] -> Service parameters ->Radius server -> TLS -> Disable RSA-PSS signature Suite in EAP-TLS

Set from FALSE to TRUE

Save for each node in the cluster.

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

You need to patch your cluster. That feature was introduced in Patch 4.

Patch 9 is the latest but, if you use Insight, Patch 8 is recommended due to a bug i Patch 9.

Hi bosborne, 

I'm not able to find this settings in my 6.11.1 cluster - do you mind sharing a screenshot? 

thanks

Assuming you are using ClearPass 6.11.x or newer, by default there is a new TLS encryoption enabled that does not work with come earlier TPM chips.

IMO the best solution is to disable it for every server in the cluster.

Administration -> Server configuration -> [CPPM node] -> Service parameters ->Radius server -> TLS -> Disable RSA-PSS signature Suite in EAP-TLS

Set from FALSE to TRUE

Save for each node in the cluster.

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.

The Insight bug exists in 6.11.0.

You need to patch your cluster. That feature was introduced in Patch 4.

Patch 9 is the latest but, if you use Insight, Patch 8 is recommended due to a bug i Patch 9.

Hi bosborne, 

I'm not able to find this settings in my 6.11.1 cluster - do you mind sharing a screenshot? 

thanks

Assuming you are using ClearPass 6.11.x or newer, by default there is a new TLS encryoption enabled that does not work with come earlier TPM chips.

IMO the best solution is to disable it for every server in the cluster.

Administration -> Server configuration -> [CPPM node] -> Service parameters ->Radius server -> TLS -> Disable RSA-PSS signature Suite in EAP-TLS

Set from FALSE to TRUE

Save for each node in the cluster.

I have GPO that push out the machine certificate to the windows 11 machines.  We have a few machines that are not able to connect to the SSID and when I look at the clearpass logs I get this error below.  I compare the thumbprint and cert on the one that are working and the one that is not working.  Everything looks the same as to the certificate and running netsh wlan show profile command.  I ran the pcap and there is nothing that pop out telling me what the client was denied.  I am hoping someone can assist me or know the issue.