OpenOTP PKi login failed - SSL certificate verify failed

Roland Schnabl

unread,

Jan 15, 2026, 9:08:32 AMJan 15

to RCDevs Security

Dear Support Team,

We are encountering an issue with our OpenOTP RADIUS Bridge where authentication is failing for EAP-TLS sessions. The process seems to successfully complete the initial handshake, but fails at the OpenOTP PKi login stage.

Symptoms:

The RADIUS debug log shows rlm_openotp: Sending openotpPKILogin request followed immediately by OpenOTP PKi login failed.
This results in an OpenSSL error: error:0A000086:SSL routines::certificate verify failed.
The client certificate details appear to be read correctly before the failure.
We have attached the anonymized debug logs below for your review. Could you please assist in troubleshooting this PKI login failure?

Anonymized Debug Log:

Best regards

Schnabl

802.1X_cert_debug.txt

Spyridon Gouliarmis (RCDevs)

unread,

Jan 15, 2026, 9:19:52 AMJan 15

to RCDevs Security

Hello Roland,

the certificate [chain] presented by WebADM on TCP port 8443 (or whatever server_url says in /opt/radiusd/con/radiusd.conf) is not signed by the CA in /opt/radiusd/conf/ca.crt . Normally this does not happen, as the /opt/radiusd/bin/setup script retrieves WebADM's CA cert, which does not change, and the certificate presented, /opt/webadm/pki/webadm.crt, is automatically generated by the setup script and re-generated by the startup script when close to peremption date.

From your radiusd host, what does this output:

openssl s_client -showcerts -connect your.webadm.host:8443 -CAfile /opt/radiusd/conf/ca.crt

Roland Schnabl

unread,

Jan 20, 2026, 4:00:16 AMJan 20

to RCDevs Security

Hello,

Attached is the output from openssl s_client -showcerts -connect mfa01.company.com:8443 -CAfile /opt/radiusd/conf/ca.crt.

Best regards,
Roland

openssl.txt

Yoann Traut (RCDevs)

unread,

Jan 22, 2026, 7:46:46 AMJan 22

to RCDevs Security

Hello,

Are you using the WebADM CA to issue the user/client certificate, or another PKI for the certificate presented by the EAP-TLS client?

Have you replaced the WebADM and RADIUS Bridge certificates located at:

/opt/webadm/pki/webadm.crt
/opt/radiusd/conf/radiusd.crt

Regards,

Roland Schnabl

unread,

Jan 23, 2026, 10:08:35 AMJan 23

to RCDevs Security

Hi,

Are you using the WebADM CA to issue the user/client certificate, or another PKI for the certificate presented by the EAP-TLS client?

No, we use certificates form the Windows CA

Have you replaced the WebADM and RADIUS Bridge certificates located at:

/opt/webadm/pki/webadm.crt - Yes from the Windows CA
/opt/radiusd/conf/radiusd.crt - Yes from the Windows CA

[2026-01-23 10:56:18] [XXX.XXX.XXX.XXX:57498] [OpenOTP:XXXXXXX9] New openotpPKILogin SOAP request
[2026-01-23 10:56:18] [XXX.XXX.XXX.XXX:57498] [OpenOTP:XXXXXXX9] > Certificate: 2609 Bytes
[2026-01-23 10:56:18] [XXX.XXX.XXX.XXX:57498] [OpenOTP:XXXXXXX9] > Client ID: XXX.XXX.XXX.XXX
[2026-01-23 10:56:18] [XXX.XXX.XXX.XXX:57498] [OpenOTP:XXXXXXX9] > Options: RADIUS,NAC
[2026-01-23 10:56:18] [XXX.XXX.XXX.XXX:57498] [OpenOTP:XXXXXXX9] > Context: XX-XX-XX-XX-XX-XX@Ethernet
[2026-01-23 10:56:18] [XXX.XXX.XXX.XXX:57498] [OpenOTP:XXXXXXX9] Registered openotpPKILogin request
[2026-01-23 10:56:18] [XXX.XXX.XXX.XXX:57498] [OpenOTP:XXXXXXX9] Client certificate not usable or not found
[2026-01-23 10:56:18] [XXX.XXX.XXX.XXX:57498] [OpenOTP:XXXXXXX9] Sent failure response

from the CLI:
curl -I --cert client.firma.de.crt --key client.firma.de.pem --cacert FIRMA-CA.crt https://mfa.firma.de:8443/openotp/
HTTP/1.1 200 OK
Date: Fri, 23 Jan 2026 11:17:30 GMT
Server: Apache
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Type: application/soap+xml; charset=utf-8

what i found so far:
In the Web GUI:
Certificate is valid and will expires in 26 days.
Certificate missing from certificate cache (check duplicates)!

but (https://docs.rcdevs.com/smartcard-provider-for-windows/ )
Start scheduled background tasks does not work!

here is the ocsp test directly from the MFA Server:
openssl ocsp -issuer FIRMA-CA.crt -cert client.firma.de.crt -text -url http://server.firma.de/ocsp
OCSP Request Data:
Version: 1 (0x0)
Requestor List:
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: E3B1CC5.........................
Issuer Key Hash: 5C6AA57.....................
Serial Number: 68000.....................
Request Extensions:
OCSP Nonce:
04108B6DCC68385ACE82199CFB7FD3756B28
OCSP Response Data:
OCSP Response Status: successful (0x0)
Response Type: Basic OCSP Response
Version: 1 (0x0)
Responder Id: 77EF166......................
Produced At: Jan 23 11:23:49 2026 GMT
Responses:
Certificate ID:
Hash Algorithm: sha1
Issuer Name Hash: E3B1C..................
Issuer Key Hash: 5C6AA....................
Serial Number: 6800015...............
Cert Status: good
This Update: Jan 23 06:20:29 2026 GMT
Next Update: Jan 23 18:40:29 2026 GMT
Response Single Extensions:
1.3.6.1.4.1.311.21.4:
260123123029Z .

Response Extensions:
OCSP Nonce:
04108B6DC.........................
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
9f:fb:d2:16:a9:36:6e:49:22:69:8d:6b:7a:a7:08:88:2c:67:
11:d1:5b:d1:02:49:6e:36:f5:c4:c9:ef:a7:62:64:fc:52:ce:
bb:f2:9f:3d
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
68:00:01:5f:0f:....................
Signature Algorithm: sha256WithRSAEncryption
Issuer: DC=de, DC=firma, CN=CA-Server-CA
Validity
Not Before: Jan 20 07:57:45 2026 GMT
Not After : Feb 3 07:57:45 2026 GMT
Subject: CN=ca-server.firma.de
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:c1:b5:66:a6:14:4f:c4:27:78:aa:0e:39:a2:c8:
01:9a:59:d3:38:1e:6f:ae:a9:1f:5a:8c:5a:e8:84:
d7:e5
Exponent: 65537 (0x10001)
X509v3 extensions:
1.3.6.1.4.1.311.21.7:
0/.'+.....7.........c...>...5...~.T...Z...&..d...
X509v3 Extended Key Usage:
OCSP Signing
X509v3 Key Usage: critical
Digital Signature
1.3.6.1.4.1.311.21.10:
0.0
..+.......
OCSP No Check:

X509v3 Authority Key Identifier:
5C:6A:A5:7F:84:C2:25:23:4F:E6:5A:A1:46:43:67:F3:EE:27:69:4A
X509v3 Subject Key Identifier:
77:EF:16:6C:2E:47:97:55:01:5B:EE:E2:3B:63:48:EE:6F:CD:54:B6
X509v3 Subject Alternative Name:
DNS:ca-server.firma.de
1.3.6.1.4.1.311.25.2:
0>.<.
+.....7......,S-1-5-21-2000478354-796845957-682003330-7630
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
93:4e:d7:ff:12:20:cb:6c:3a:c1:d6:c3:13:fe:b1:73:74:d3:
74:ea:d0:88
-----BEGIN CERTIFICATE-----
MIIENjCCAx6gAwIBAgITaAABXw+aOTpPAFjnOQACAAFfDzANBgkqhkiG9w0BAQsF
lPEXoygOkyA0NnHH3BV0DtPKBusKe3Tq0Ig=
-----END CERTIFICATE-----
Response verify OK
client.firma.de.crt: good
This Update: Jan 23 06:20:29 2026 GMT
Next Update: Jan 23 18:40:29 2026 GMT

Best regards

Schnabl

Yoann Traut (RCDevs)

unread,

Jan 23, 2026, 10:22:41 AMJan 23

to RCDevs Security

Hello,

I tested it and it does not seem to work with a certificate issued by Active Directory, although it should.
I will check with the development team and get back to you as soon as possible.

Regards

Yoann Traut (RCDevs)

unread,

Jan 26, 2026, 5:31:32 AMJan 26

to RCDevs Security

Hello,

The issue has been fixed and will be included in this week’s upcoming release.

Regards

Reply all

Reply to author

Forward