OpenSSL must be installed to use either EAP-TLS, EAP-TTLS, or PEAP!
When using EAP-TLS, both the Authentication Server and all the Supplicants (clients) need certificates [RFC2459] . Using EAP-TTLS or PEAP, only the Authentication Server requires certificates; Supplicant certificates are optional.
You get certificates from the local certificate authority (CA). If there is no local CA available, OpenSSL may be used to generate self-signed certificates.
Included with the FreeRADIUS source are
some helper scripts to generate self-signed certificates. The scripts
are located under the scripts/ folder included
with the FreeRADIUS source:
CA.all is a shell script that generates
certificates based on some questions it
ask. CA.certs generates certificates
non-interactively based on pre-defined information at the start of
the script.
The scripts uses a Perl script called CA.pl,
included with OpenSSL. The path to this Perl script
in CA.all and CA.certs may
need to be changed to make it work.
More information on how to generate your own certificates can be found in the SSL certificates HOWTO.