[defect]:Self-signed certificate authority to access the sqlradius database.

[amagerard]

What type of defect/bug is this?

Crash or memory corruption (segv, abort, etc...)

How can the issue be reproduced?

Modules sql and ldap.
SQL queries or ldap with a self-signed certificate authority of type rsa no longer work after release openssl-3.0.7-27 el9 .

https://github.com/amagerard/Freeradius/wiki/04InstanceDefault
4.3 Create a self-signed certificate.

I am preparing freeradius 3.2.8 with Redhat 10 and I still encounter the same problem.
I chose the workaround of creating the CA with almalinux version 9.4. only for sql or ldap.

Log output from the FreeRADIUS daemon

radiusd -d /etc/freeradius-sql -l /var/log/freeradius-sql/radius.log -X
 rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
Sat Oct 18 20:54:04 2025 : Info: rlm_sql_mysql: libmysql version: 3.4.7
Sat Oct 18 20:54:04 2025 : Info: rlm_sql (sql): Attempting to connect to database "sqlradius"
Sat Oct 18 20:54:04 2025 : Error: rlm_sql_mysql: Couldn't connect to MySQL server admsql@daloradius.ol26modk.com:sqlradius
Sat Oct 18 20:54:04 2025 : Error: rlm_sql_mysql: MySQL error: TLS/SSL error:

Relevant log output from client utilities

No response

Backtrace from LLDB or GDB

[alandekok]

This is likely an OpenSSL issue. But you might also try the head of the v3.2.x branch.

See commit 59e262f for a patch which might help.

[amagerard]

I'll rephrase my request.

This concerns FreeRadius versions 3.2.7 and 3.2.8.

FreeRadius host server and sqlradius database hosted on another server require the same self-signed certificate authority to access the sqlradius database.

Since the new version of OpenSSL v3, the FreeRadius host server can no longer communicate with
the sqlradius database hosted on another server.

This issue is the same between a FreeRadius host server and an LDAP database hosted on another
server.

Only the self-signed certificate authority is affected.
I can generate certification requests signed by the CA with OpenSSLV3.

It's fine if the certificate authority is generated by an OpenSSL V1 version.
It's possible to generate a self-signed OpenSSL version 1 CA with RedHat 9.4 or Debian 12.

This isn't urgent because self-signed CA on my servers are three or even five years old.

[alandekok]

This is very likely an OpenSSL issue. FreeRADIUS doesn't do any OpenSSL API calls to connect over TLS to an LDAP server.

You will have to update your certificates and/or the TLS configuration so that they comply with the new OpenSSL security policies.

[amagerard]

Thank you very much for taking the time to give me your answer.
You're right.
The issue isn't with Freeradius.

I need to generate my CA as recommended:

https://www.bytebase.com/reference/mariadb/how-to/how-to-configure-mariadb-ssl-connection/

And it works perfectly.