Added ability to verify client certificates

[freeradius.git] / raddb / eap.conf

diff --git a/raddb/eap.conf b/raddb/eap.conf
index 0de4884..4e769ee 100644 (file)
--- a/raddb/eap.conf
+++ b/raddb/eap.conf
@@ -225,7 +225,7 @@
                        #  3) uncomment the line below.
                        #  5) Restart radiusd
                #       check_crl = yes
-               #       CA_path = /path/to/directory/with/ca_certs/and/crls/
+                       CA_path = ${cadir}
 
                       #
                       #  If check_cert_issuer is set, the value will
@@ -320,6 +320,44 @@
                              #
                              max_entries = 255
                        }
+
+                       #
+                       #  As of version 2.1.10, client certificates can be
+                       #  validated via an external command.  This allows
+                       #  dynamic CRLs or OCSP to be used.
+                       #
+                       #  This configuration is commented out in the
+                       #  default configuration.  Uncomment it, and configure
+                       #  the correct paths below to enable it.
+                       #
+                       verify {
+                               #  A temporary directory where the client
+                               #  certificates are stored.  This directory
+                               #  MUST be owned by the UID of the server,
+                               #  and MUST not be accessible by any other
+                               #  users.  When the server starts, it will do
+                               #  "chmod go-rwx" on the directory, for
+                               #  security reasons.  The directory MUST
+                               #  exist when the server starts.
+                               #
+                               #  You should also delete all of the files
+                               #  in the directory when the server starts.
+               #               tmpdir = /tmp/radiusd
+
+                               #  The command used to verify the client cert.
+                               #  We recommend using the OpenSSL command-line
+                               #  tool.
+                               #
+                               #  The ${..CA_path} text is a reference to
+                               #  the CA_path variable defined above.
+                               #
+                               #  The %{TLS-Client-Cert-Filename} is the name
+                               #  of the temporary file containing the cert
+                               #  in PEM format.  This file is automatically
+                               #  deleted by the server when the command
+                               #  returns.
+               #               client = "/path/to/openssl verify -CApath ${..CA_path} %{TLS-Client-Cert-Filename}"
+                       }
                }
 
                #  The TTLS module implements the EAP-TTLS protocol,