{"id":9616,"date":"2023-06-02T05:32:30","date_gmt":"2023-06-02T05:32:30","guid":{"rendered":"https:\/\/aranya.se\/?p=9616"},"modified":"2025-04-01T16:01:41","modified_gmt":"2025-04-01T14:01:41","slug":"windows-clients-affected-by-problems-with-tpm-chip-after-clearpass-6-11","status":"publish","type":"post","link":"https:\/\/aranya-old.hemsida.eu\/en\/windows-clients-affected-by-problems-with-tpm-chip-after-clearpass-6-11\/","title":{"rendered":"Windows clients affected by problems with TPM chip after ClearPass 6.11"},"content":{"rendered":"\n
In the process of installing ClearPass 6.11 with customers, Aranya has encountered a problem that occurs for some specific computers when certain conditions are met. The problem means that the computers cannot authenticate to the network. Below is a description of the problem and how it can be overcome in different ways.<\/p>\n\n
Background<\/h2>\n\n
ClearPass 6.11 is based on a new underlying operating system, RedHat Enterprise Linux (RHEL), and therefore requires a reinstallation of the server if it is a physical server or a new server if it is virtual.<\/p>\n\n
RHEL was chosen because the previous CentOS version was approaching end of life and would have had to be replaced anyway with a new OS. With RHEL, Aruba is better able to build a secure platform. ClearPass 6.11 introduces a number of new features, one of which is the introduction of a cryptographic algorithm called PSS RSA in ClearPass 6.11. This algorithm has been available in Windows for some time but has not been used because ClearPass did not support this algorithm.<\/p>\n\n
Now that ClearPass supports PSS RSA, the computer will choose that algorithm. However, it has been found that a number of, mainly older, computers have a TPM chip that has a firmware version that has a bug that makes the signing not work properly.<\/p>\n\n
The problems occur when the following factors are met:– Computer with Windows 10 & 11– Certificate in TPM chip– TPM 2.0– TPM Sub version 1.16– ClearPass 6.11<\/p>\n\n
Technical description of the problem and error symptoms<\/h2>\n\n
During the EAP phase of authentication, the client and ClearPass hands shake on which algorithm to use and agree that PSS RSA is the best common algorithm. If the certificate is stored in the TPM chip and the TPM sub version is 1.16, there is an error in that software version that causes the hash created to contain only zeros instead of the correct hash.<\/p>\n\n
The TPM sub version can be updated on some computers, but some lack newer versions for the specific TPM chip. These computers cannot be updated to solve the problem. In these cases, the computers either need to be replaced or the algorithm deactivated.<\/p>\n\n
The problem is described in the release notes for ClearPass 6.11 as a known bug with reference number CP-49353.<\/p>\n\n
Symptom<\/h3>\n\n
From ClearPass, the most obvious symptom is that some clients cannot authenticate and the error message is this in the Access Tracker:<\/p>\n\n
Error Code:<\/td>
215<\/td><\/tr>
Error Category:<\/td>
Authentication failure<\/td><\/tr>
Error Message:<\/td>
TLS session error<\/td><\/tr>
Alerts for this Request<\/strong> RADIUS EAP-TLS: fatal alert by server – decrypt_errorTLS Handshake failed in SSL_read with error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last byte invalideap-tls: Error in establishing TLS session<\/td><\/tr><\/tbody><\/table><\/figure>\n\n
Screenshot of the ClearPass Access Tracker with the current error message.<\/figcaption><\/figure>\n\n
On the client, the symptom is that it fails to authenticate to the network and is thus cut off from all communication.<\/p>\n\n
Workaround<\/h2>\n\n
From ClearPass, nothing can be done about the problem at the moment as it is a client-related issue. However, a feature request has been sent to Aruba to get a possibility to disable PSS RSA with a setting in the administrative interface and Aruba has replied that they are looking into the possibilities.<\/p>\n\n
For the client computers affected by this problem, the solution is to either update the TPM sub version to a higher version than 1.16 if it is available for the specific computer model.<\/p>\n\n
If it is not available for the current computer model, PSS RSA needs to be disabled on the client side. This is most easily done with a GPO if it is a domain-connected computer. Alternatively, the settings are distributed by other means.<\/p>\n\n
Since the client will not be able to access the web if it is affected by this bug, the fix should be applied before authentication starts to be handled by ClearPass 6.11.<\/p>\n\n
If the problem is only discovered later, the changes can also be made manually or by script with a user with local admin privileges.<\/p>\n\n
Disable PSS RSA in Windows<\/h3>\n\n
Computer\\HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Cryptography\\Configuration\\Local\\SSL\\00010003Delete the following values:RSAE-PSS\/SHA256RSAE-PSS\/SHA384RSAE-PSS\/SHA512<\/p>\n\n
Screenshot of the Registry Editor showing the key to be modified.<\/figcaption><\/figure>\n\n
Update<\/h2>\n\n
In ClearPass 6.11.4, the ability to turn off PSS RSA was introduced. This is done on each ClearPass server under Service Parameters for RADIUS Server. <\/p>\n\n
![\"\"](\"https:\/\/aranya-old.hemsida.eu\/wp-content\/uploads\/2023\/06\/76c6bf536a674cafabdbf4a7e37744fc-1024x349.png\")
![\"\"](\"https:\/\/aranya-old.hemsida.eu\/wp-content\/uploads\/2023\/06\/0badc6c6d0bd454fa664454086bd4a40.png\")
![\"\"](\"https:\/\/aranya-old.hemsida.eu\/wp-content\/uploads\/2023\/06\/image-1024x124.png\")
<\/figure>\n\n![\"\"](\"https:\/\/aranya-old.hemsida.eu\/wp-content\/uploads\/2023\/06\/image-1.png\")
<\/figure>\n\n