Changes to automatically provision,build and run Radius containers for Auth tests.
Changes to cord test server to handle radius server restart requests.
diff --git a/src/test/setup/radius-config/freeradius/certs_2/01.pem b/src/test/setup/radius-config/freeradius/certs_2/01.pem
new file mode 100644
index 0000000..246df1b
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/01.pem
@@ -0,0 +1,80 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 1 (0x1)
+ Signature Algorithm: sha1WithRSAEncryption
+ Issuer: C=US, ST=CA, L=Somewhere, O=Ciena Inc./emailAddress=admin@ciena.com, CN=Example Certificate Authority
+ Validity
+ Not Before: Mar 11 18:53:35 2016 GMT
+ Not After : Mar 6 18:53:35 2017 GMT
+ Subject: C=US, ST=CA, O=Ciena Inc., CN=Example Server Certificate/emailAddress=admin@ciena.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (2048 bit)
+ Modulus:
+ 00:a7:9b:3d:b2:8f:6d:dd:55:c7:34:5a:8b:c7:78:
+ a8:ff:14:fa:21:0e:60:1b:0c:87:36:f1:07:3a:cc:
+ f1:8a:9d:23:4c:31:8d:81:92:0b:1f:b2:f9:6f:55:
+ 79:c3:fd:18:8f:99:a7:8b:8c:41:18:a6:02:08:cb:
+ b5:5b:8b:b7:23:a3:6d:20:a9:ec:ee:bf:fa:f1:99:
+ d7:07:35:a1:3b:e9:5e:b7:84:8a:db:5d:46:15:3e:
+ 1f:92:2d:12:db:4c:c3:aa:13:c7:dd:2d:a0:0a:d2:
+ 3c:59:19:fa:7c:d9:a5:b4:16:bd:82:ba:35:47:c4:
+ dc:fb:af:61:f1:70:d8:b3:2c:ef:91:20:c5:d5:af:
+ b7:ac:5d:15:4e:ea:64:ab:0b:b3:ee:25:7e:aa:a8:
+ a0:a5:36:2e:59:ed:b8:c7:02:4f:ab:9b:e7:50:4c:
+ 30:14:4d:48:1a:a2:88:05:6e:7e:82:ef:f8:c5:70:
+ b5:d8:3e:ae:f6:e0:2e:68:ba:52:d3:e5:3a:2d:0f:
+ dd:43:86:39:b5:af:5b:c3:86:7b:98:78:7f:d5:9b:
+ ee:9f:e4:50:5e:03:9e:29:67:f5:78:35:b1:d3:e2:
+ 66:2d:68:36:c2:30:c9:06:c2:1c:73:9b:c3:09:28:
+ ba:08:b8:f5:49:e0:5b:d1:43:d9:38:06:47:32:a2:
+ de:a9
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Extended Key Usage:
+ TLS Web Server Authentication
+ X509v3 CRL Distribution Points:
+
+ Full Name:
+ URI:http://www.example.com/example_ca.crl
+
+ Signature Algorithm: sha1WithRSAEncryption
+ 58:cd:50:ef:5f:b1:3e:34:a2:5d:f4:59:f6:11:25:be:de:b2:
+ f8:58:81:2a:89:f0:e7:df:36:88:49:8e:d2:c4:44:22:6c:40:
+ a4:13:6c:8c:15:9d:f2:9e:32:29:ff:31:f0:82:92:3e:93:58:
+ ce:eb:da:9b:19:76:7d:de:54:c5:b1:b2:2e:66:4c:7b:7c:9c:
+ 98:12:f9:20:aa:d3:c7:d3:0b:70:5a:c3:24:d7:b9:92:8e:38:
+ fe:54:21:c6:c9:e4:c8:b8:b6:ae:8a:0e:2d:18:95:53:da:b6:
+ 9b:94:12:0d:68:e8:ef:0a:78:8b:29:cc:0f:59:a4:d8:dc:6c:
+ 34:b2:7a:6f:de:63:1e:e1:03:d2:f3:ca:b6:26:05:f4:22:51:
+ 2a:ff:78:d1:07:b3:e7:7e:ab:68:33:2a:0a:d0:cc:be:26:ea:
+ 6a:6e:10:d7:2b:7a:7b:cb:e6:0d:50:66:7f:9a:33:31:ad:8d:
+ 1b:3b:3f:8e:74:29:3d:07:37:9d:4d:29:ad:b6:cc:84:d8:1c:
+ 09:48:61:ce:67:30:ee:74:25:fe:23:5a:8d:00:f6:1a:5d:de:
+ 04:70:a7:ea:e9:6f:b0:25:10:f4:3a:70:ab:5a:57:5f:53:12:
+ d8:0e:52:f4:f2:f5:dc:25:71:e5:46:24:09:65:95:22:1b:35:
+ 8b:78:9b:6f
+-----BEGIN CERTIFICATE-----
+MIIDyjCCArKgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM1WhcN
+MTcwMzA2MTg1MzM1WjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xIzAhBgNVBAMTGkV4YW1wbGUgU2VydmVyIENlcnRpZmlj
+YXRlMR4wHAYJKoZIhvcNAQkBFg9hZG1pbkBjaWVuYS5jb20wggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCnmz2yj23dVcc0WovHeKj/FPohDmAbDIc28Qc6
+zPGKnSNMMY2BkgsfsvlvVXnD/RiPmaeLjEEYpgIIy7Vbi7cjo20gqezuv/rxmdcH
+NaE76V63hIrbXUYVPh+SLRLbTMOqE8fdLaAK0jxZGfp82aW0Fr2CujVHxNz7r2Hx
+cNizLO+RIMXVr7esXRVO6mSrC7PuJX6qqKClNi5Z7bjHAk+rm+dQTDAUTUgaoogF
+bn6C7/jFcLXYPq724C5oulLT5TotD91Dhjm1r1vDhnuYeH/Vm+6f5FBeA54pZ/V4
+NbHT4mYtaDbCMMkGwhxzm8MJKLoIuPVJ4FvRQ9k4Bkcyot6pAgMBAAGjTzBNMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly93d3cu
+ZXhhbXBsZS5jb20vZXhhbXBsZV9jYS5jcmwwDQYJKoZIhvcNAQEFBQADggEBAFjN
+UO9fsT40ol30WfYRJb7esvhYgSqJ8OffNohJjtLERCJsQKQTbIwVnfKeMin/MfCC
+kj6TWM7r2psZdn3eVMWxsi5mTHt8nJgS+SCq08fTC3BawyTXuZKOOP5UIcbJ5Mi4
+tq6KDi0YlVPatpuUEg1o6O8KeIspzA9ZpNjcbDSyem/eYx7hA9LzyrYmBfQiUSr/
+eNEHs+d+q2gzKgrQzL4m6mpuENcrenvL5g1QZn+aMzGtjRs7P450KT0HN51NKa22
+zITYHAlIYc5nMO50Jf4jWo0A9hpd3gRwp+rpb7AlEPQ6cKtaV19TEtgOUvTy9dwl
+ceVGJAlllSIbNYt4m28=
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/02.pem b/src/test/setup/radius-config/freeradius/certs_2/02.pem
new file mode 100644
index 0000000..1197fec
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/02.pem
@@ -0,0 +1,80 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 2 (0x2)
+ Signature Algorithm: sha1WithRSAEncryption
+ Issuer: C=US, ST=CA, L=Somewhere, O=Ciena Inc./emailAddress=admin@ciena.com, CN=Example Certificate Authority
+ Validity
+ Not Before: Mar 11 18:53:36 2016 GMT
+ Not After : Mar 6 18:53:36 2017 GMT
+ Subject: C=US, ST=CA, O=Ciena Inc., CN=user@ciena.com/emailAddress=user@ciena.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (2048 bit)
+ Modulus:
+ 00:ec:5e:99:c0:6c:3e:7f:6d:66:c0:9a:e6:8d:89:
+ 03:ab:10:0c:2e:c0:e8:98:02:35:75:e5:d9:51:73:
+ 28:b3:4d:bc:1f:4f:4b:a0:fb:64:1b:10:e4:09:f4:
+ cc:40:cc:37:38:b9:d6:ae:e5:9e:b6:20:d5:7c:a2:
+ 13:84:bc:17:33:06:00:5a:fd:e1:19:46:31:02:54:
+ 6d:10:fd:57:fa:2a:b3:33:17:e2:4f:be:88:03:8a:
+ b4:80:35:82:bd:f1:ed:98:be:d2:d9:23:55:25:73:
+ 5d:39:a0:36:78:42:84:06:a6:74:cb:23:61:41:b9:
+ f8:26:3d:58:08:9c:5f:2c:be:54:45:77:cd:3a:61:
+ 65:90:d1:3a:37:23:12:9e:26:fd:34:97:54:f6:0f:
+ 81:80:d7:23:8d:18:64:a5:f9:05:db:ea:ca:45:ad:
+ 4f:fb:48:81:96:f8:f1:14:b5:34:fc:8d:fd:79:02:
+ 63:39:77:6e:fd:b5:ab:1e:cc:73:47:dc:11:bb:09:
+ 04:82:11:61:35:24:7f:19:ec:8a:57:27:98:bc:52:
+ 60:ef:a9:f8:36:7d:b8:12:c1:cd:c4:2d:fb:84:5d:
+ e6:92:d2:7e:2d:b5:58:cd:fd:d9:9d:a8:3a:2d:ef:
+ b3:f3:98:00:f0:2a:82:68:b6:25:63:af:de:67:8f:
+ 6b:ff
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Extended Key Usage:
+ TLS Web Client Authentication
+ X509v3 CRL Distribution Points:
+
+ Full Name:
+ URI:http://www.example.com/example_ca.crl
+
+ Signature Algorithm: sha1WithRSAEncryption
+ 2c:1c:cc:3c:34:c8:07:ab:0b:c8:f9:74:4f:a2:55:32:33:a4:
+ ca:57:40:56:15:d6:89:0b:13:8d:a1:90:18:95:14:7b:57:26:
+ 50:9c:99:6d:46:44:73:5d:cc:ca:05:cc:3c:e3:38:c7:bc:fa:
+ 56:95:c6:ba:ad:5c:fd:5c:67:57:34:36:7c:d9:db:25:c2:00:
+ 1e:2f:fb:1b:c5:b9:fd:24:1f:3d:eb:08:54:3b:07:4c:47:38:
+ 66:ca:4f:8b:98:e5:4b:f3:15:5f:71:ce:0b:e0:43:6c:e8:dd:
+ 6f:0a:8f:45:7d:09:12:bf:ae:3b:28:63:3b:e9:51:c4:6f:22:
+ 94:c4:40:0a:80:54:6f:0d:5e:0e:e5:43:a0:40:60:12:b4:94:
+ 0b:8e:29:ab:98:a8:0f:0d:b1:7a:57:3e:63:a8:50:76:6b:58:
+ c1:f6:34:0d:bb:f0:c4:7b:40:e3:de:5f:ac:bc:8f:71:ab:2d:
+ 0e:24:ff:ce:b7:bb:34:be:75:33:25:03:3e:38:d8:8e:08:4d:
+ 40:4c:2f:bb:ae:88:29:b4:37:4f:5b:49:06:b8:08:ef:f5:88:
+ f9:da:a1:28:11:68:94:a1:8a:4c:35:88:1e:c6:57:42:f6:75:
+ b2:71:ae:fc:54:58:ce:0d:65:f9:1f:e3:4f:c7:11:07:d0:43:
+ c2:15:2d:ca
+-----BEGIN CERTIFICATE-----
+MIIDvTCCAqWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM2WhcN
+MTcwMzA2MTg1MzM2WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAOxemcBsPn9tZsCa5o2JA6sQDC7A6JgCNXXl2VFzKLNNvB9PS6D7ZBsQ
+5An0zEDMNzi51q7lnrYg1XyiE4S8FzMGAFr94RlGMQJUbRD9V/oqszMX4k++iAOK
+tIA1gr3x7Zi+0tkjVSVzXTmgNnhChAamdMsjYUG5+CY9WAicXyy+VEV3zTphZZDR
+OjcjEp4m/TSXVPYPgYDXI40YZKX5BdvqykWtT/tIgZb48RS1NPyN/XkCYzl3bv21
+qx7Mc0fcEbsJBIIRYTUkfxnsilcnmLxSYO+p+DZ9uBLBzcQt+4Rd5pLSfi21WM39
+2Z2oOi3vs/OYAPAqgmi2JWOv3mePa/8CAwEAAaNPME0wEwYDVR0lBAwwCgYIKwYB
+BQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5leGFtcGxlLmNvbS9l
+eGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOCAQEALBzMPDTIB6sLyPl0T6JV
+MjOkyldAVhXWiQsTjaGQGJUUe1cmUJyZbUZEc13MygXMPOM4x7z6VpXGuq1c/Vxn
+VzQ2fNnbJcIAHi/7G8W5/SQfPesIVDsHTEc4ZspPi5jlS/MVX3HOC+BDbOjdbwqP
+RX0JEr+uOyhjO+lRxG8ilMRACoBUbw1eDuVDoEBgErSUC44pq5ioDw2xelc+Y6hQ
+dmtYwfY0DbvwxHtA495frLyPcastDiT/zre7NL51MyUDPjjYjghNQEwvu66IKbQ3
+T1tJBrgI7/WI+dqhKBFolKGKTDWIHsZXQvZ1snGu/FRYzg1l+R/jT8cRB9BDwhUt
+yg==
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/07a45775.0 b/src/test/setup/radius-config/freeradius/certs_2/07a45775.0
new file mode 120000
index 0000000..799a1c6
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/07a45775.0
@@ -0,0 +1 @@
+client.pem
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_2/19a996e2.0 b/src/test/setup/radius-config/freeradius/certs_2/19a996e2.0
new file mode 120000
index 0000000..799a1c6
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/19a996e2.0
@@ -0,0 +1 @@
+client.pem
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_2/34e00910.0 b/src/test/setup/radius-config/freeradius/certs_2/34e00910.0
new file mode 120000
index 0000000..55f0c91
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/34e00910.0
@@ -0,0 +1 @@
+01.pem
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_2/865470fd.0 b/src/test/setup/radius-config/freeradius/certs_2/865470fd.0
new file mode 120000
index 0000000..e375f5a
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/865470fd.0
@@ -0,0 +1 @@
+ca.pem
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_2/8fe581ba.0 b/src/test/setup/radius-config/freeradius/certs_2/8fe581ba.0
new file mode 120000
index 0000000..55f0c91
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/8fe581ba.0
@@ -0,0 +1 @@
+01.pem
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_2/Makefile b/src/test/setup/radius-config/freeradius/certs_2/Makefile
new file mode 100644
index 0000000..c8f0892
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/Makefile
@@ -0,0 +1,140 @@
+######################################################################
+#
+# Make file to be installed in /etc/raddb/certs to enable
+# the easy creation of certificates.
+#
+# See the README file in this directory for more information.
+#
+# $Id: 0613df99502989a6d5751eb8b2088000c58cae98 $
+#
+######################################################################
+
+DH_KEY_SIZE = 1024
+
+#
+# Set the passwords
+#
+PASSWORD_SERVER = `grep output_password server.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CA = `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CLIENT = `grep output_password client.cnf | sed 's/.*=//;s/^ *//'`
+
+USER_NAME = `grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *//'`
+CA_DEFAULT_DAYS = `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'`
+
+######################################################################
+#
+# Make the necessary files, but not client certificates.
+#
+######################################################################
+.PHONY: all
+all: index.txt serial dh random server ca client
+
+.PHONY: client
+client: client.pem
+
+.PHONY: ca
+ca: ca.der
+
+.PHONY: server
+server: server.pem server.vrfy
+
+######################################################################
+#
+# Diffie-Hellman parameters
+#
+######################################################################
+dh:
+ openssl dhparam -out dh $(DH_KEY_SIZE)
+
+######################################################################
+#
+# Create a new self-signed CA certificate
+#
+######################################################################
+ca.key ca.pem: ca.cnf
+ @[ -f index.txt ] || $(MAKE) index.txt
+ @[ -f serial ] || $(MAKE) serial
+ openssl req -new -x509 -keyout ca.key -out ca.pem \
+ -days $(CA_DEFAULT_DAYS) -config ./ca.cnf
+
+ca.der: ca.pem
+ openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der
+
+######################################################################
+#
+# Create a new server certificate, signed by the above CA.
+#
+######################################################################
+server.csr server.key: server.cnf
+ openssl req -new -out server.csr -keyout server.key -config ./server.cnf
+
+server.crt: server.csr ca.key ca.pem
+ openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key $(PASSWORD_CA) -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf
+
+server.p12: server.crt
+ openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
+
+server.pem: server.p12
+ openssl pkcs12 -in server.p12 -out server.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
+
+.PHONY: server.vrfy
+server.vrfy: ca.pem
+ @openssl verify -CAfile ca.pem server.pem
+
+######################################################################
+#
+# Create a new client certificate, signed by the the above server
+# certificate.
+#
+######################################################################
+client.csr client.key: client.cnf
+ openssl req -new -out client.csr -keyout client.key -config ./client.cnf
+
+client.crt: client.csr ca.pem ca.key
+ openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+
+client.p12: client.crt
+ openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
+
+client.pem: client.p12
+ openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
+ cp client.pem $(USER_NAME).pem
+
+.PHONY: client.vrfy
+client.vrfy: ca.pem client.pem
+ c_rehash .
+ openssl verify -CApath . client.pem
+
+######################################################################
+#
+# Miscellaneous rules.
+#
+######################################################################
+index.txt:
+ @touch index.txt
+
+serial:
+ @echo '01' > serial
+
+random:
+ @if [ -c /dev/urandom ] ; then \
+ ln -sf /dev/urandom random; \
+ else \
+ date > ./random; \
+ fi
+
+print:
+ openssl x509 -text -in server.crt
+
+printca:
+ openssl x509 -text -in ca.pem
+
+clean:
+ @rm -f *~ *old client.csr client.key client.crt client.p12 client.pem
+
+#
+# Make a target that people won't run too often.
+#
+destroycerts:
+ rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
+ serial* random *\.0 *\.1
diff --git a/src/test/setup/radius-config/freeradius/certs_2/Makefile.orig b/src/test/setup/radius-config/freeradius/certs_2/Makefile.orig
new file mode 100644
index 0000000..c8f0892
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/Makefile.orig
@@ -0,0 +1,140 @@
+######################################################################
+#
+# Make file to be installed in /etc/raddb/certs to enable
+# the easy creation of certificates.
+#
+# See the README file in this directory for more information.
+#
+# $Id: 0613df99502989a6d5751eb8b2088000c58cae98 $
+#
+######################################################################
+
+DH_KEY_SIZE = 1024
+
+#
+# Set the passwords
+#
+PASSWORD_SERVER = `grep output_password server.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CA = `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'`
+PASSWORD_CLIENT = `grep output_password client.cnf | sed 's/.*=//;s/^ *//'`
+
+USER_NAME = `grep emailAddress client.cnf | grep '@' | sed 's/.*=//;s/^ *//'`
+CA_DEFAULT_DAYS = `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'`
+
+######################################################################
+#
+# Make the necessary files, but not client certificates.
+#
+######################################################################
+.PHONY: all
+all: index.txt serial dh random server ca client
+
+.PHONY: client
+client: client.pem
+
+.PHONY: ca
+ca: ca.der
+
+.PHONY: server
+server: server.pem server.vrfy
+
+######################################################################
+#
+# Diffie-Hellman parameters
+#
+######################################################################
+dh:
+ openssl dhparam -out dh $(DH_KEY_SIZE)
+
+######################################################################
+#
+# Create a new self-signed CA certificate
+#
+######################################################################
+ca.key ca.pem: ca.cnf
+ @[ -f index.txt ] || $(MAKE) index.txt
+ @[ -f serial ] || $(MAKE) serial
+ openssl req -new -x509 -keyout ca.key -out ca.pem \
+ -days $(CA_DEFAULT_DAYS) -config ./ca.cnf
+
+ca.der: ca.pem
+ openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der
+
+######################################################################
+#
+# Create a new server certificate, signed by the above CA.
+#
+######################################################################
+server.csr server.key: server.cnf
+ openssl req -new -out server.csr -keyout server.key -config ./server.cnf
+
+server.crt: server.csr ca.key ca.pem
+ openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key $(PASSWORD_CA) -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf
+
+server.p12: server.crt
+ openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
+
+server.pem: server.p12
+ openssl pkcs12 -in server.p12 -out server.pem -passin pass:$(PASSWORD_SERVER) -passout pass:$(PASSWORD_SERVER)
+
+.PHONY: server.vrfy
+server.vrfy: ca.pem
+ @openssl verify -CAfile ca.pem server.pem
+
+######################################################################
+#
+# Create a new client certificate, signed by the the above server
+# certificate.
+#
+######################################################################
+client.csr client.key: client.cnf
+ openssl req -new -out client.csr -keyout client.key -config ./client.cnf
+
+client.crt: client.csr ca.pem ca.key
+ openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key $(PASSWORD_CA) -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+
+client.p12: client.crt
+ openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
+
+client.pem: client.p12
+ openssl pkcs12 -in client.p12 -out client.pem -passin pass:$(PASSWORD_CLIENT) -passout pass:$(PASSWORD_CLIENT)
+ cp client.pem $(USER_NAME).pem
+
+.PHONY: client.vrfy
+client.vrfy: ca.pem client.pem
+ c_rehash .
+ openssl verify -CApath . client.pem
+
+######################################################################
+#
+# Miscellaneous rules.
+#
+######################################################################
+index.txt:
+ @touch index.txt
+
+serial:
+ @echo '01' > serial
+
+random:
+ @if [ -c /dev/urandom ] ; then \
+ ln -sf /dev/urandom random; \
+ else \
+ date > ./random; \
+ fi
+
+print:
+ openssl x509 -text -in server.crt
+
+printca:
+ openssl x509 -text -in ca.pem
+
+clean:
+ @rm -f *~ *old client.csr client.key client.crt client.p12 client.pem
+
+#
+# Make a target that people won't run too often.
+#
+destroycerts:
+ rm -f *~ dh *.csr *.crt *.p12 *.der *.pem *.key index.txt* \
+ serial* random *\.0 *\.1
diff --git a/src/test/setup/radius-config/freeradius/certs_2/README b/src/test/setup/radius-config/freeradius/certs_2/README
new file mode 100644
index 0000000..f7e0591
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/README
@@ -0,0 +1,226 @@
+ This directory contains scripts to create the server certificates.
+To make a set of default (i.e. test) certificates, simply type:
+
+$ ./bootstrap
+
+ The "openssl" command will be run against the sample configuration
+files included here, and will make a self-signed certificate authority
+(i.e. root CA), and a server certificate. This "root CA" should be
+installed on any client machine needing to do EAP-TLS, PEAP, or
+EAP-TTLS.
+
+ The Microsoft "XP Extensions" will be automatically included in the
+server certificate. Without those extensions Windows clients will
+refuse to authenticate to FreeRADIUS.
+
+ The root CA and the "XP Extensions" file also contain a crlDistributionPoints
+attribute. The latest release of Windows Phone needs this to be present
+for the handset to validate the RADIUS server certificate. The RADIUS
+server must have the URI defined but the CA need not have...however it
+is best practice for a CA to have a revocation URI. Note that whilst
+the Windows Mobile client cannot actually use the CRL when doing 802.1X
+it is recommended that the URI be an actual working URL and contain a
+revocation format file as there may be other OS behaviour at play and
+future OSes that may do something with that URI.
+
+ In general, you should use self-signed certificates for 802.1x (EAP)
+authentication. When you list root CAs from other organisations in
+the "ca_file", you permit them to masquerade as you, to authenticate
+your users, and to issue client certificates for EAP-TLS.
+
+ If FreeRADIUS was configured to use OpenSSL, then simply starting
+the server in root in debugging mode should also create test
+certificates, i.e.:
+
+$ radiusd -X
+
+ That will cause the EAP-TLS module to run the "bootstrap" script in
+this directory. The script will be executed only once, the first time
+the server has been installed on a particular machine. This bootstrap
+script SHOULD be run on installation of any pre-built binary package
+for your OS. In any case, the script will ensure that it is not run
+twice, and that it does not over-write any existing certificates.
+
+ If you already have CA and server certificates, rename (or delete)
+this directory, and create a new "certs" directory containing your
+certificates. Note that the "make install" command will NOT
+over-write your existing "raddb/certs" directory, which means that the
+"bootstrap" command will not be run.
+
+
+ NEW INSTALLATIONS OF FREERADIUS
+
+
+ We suggest that new installations use the test certificates for
+initial tests, and then create real certificates to use for normal
+user authentication. See the instructions below for how to create the
+various certificates. The old test certificates can be deleted by
+running the following command:
+
+$ rm -f *.pem *.der *.csr *.crt *.key *.p12 serial* index.txt*
+
+ Then, follow the instructions below for creating real certificates.
+
+ Once the final certificates have been created, you can delete the
+"bootstrap" command from this directory, and delete the
+"make_cert_command" configuration from the "tls" sub-section of
+eap.conf.
+
+ If you do not want to enable EAP-TLS, PEAP, or EAP-TTLS, then delete
+the relevant sub-sections from the "eap.conf" file.
+
+
+ MAKING A ROOT CERTIFICATE
+
+
+$ vi ca.cnf
+
+ Edit the "input_password" and "output_password" fields to be the
+ password for the CA certificate.
+
+ Edit the [certificate_authority] section to have the correct values
+ for your country, state, etc.
+
+$ make ca.pem
+
+ This step creates the CA certificate.
+
+$ make ca.der
+
+ This step creates the DER format of the self-signed certificate,
+ which is can be imported into Windows.
+
+
+ MAKING A SERVER CERTIFICATE
+
+
+$ vi server.cnf
+
+ Edit the "input_password" and "output_password" fields to be the
+ password for the server certificate.
+
+ Edit the [server] section to have the correct values for your
+ country, state, etc. Be sure that the commonName field here is
+ different from the commonName for the CA certificate.
+
+$ make server.pem
+
+ This step creates the server certificate.
+
+ If you have an existing certificate authority, and wish to create a
+ certificate signing request for the server certificate, edit
+ server.cnf as above, and type the following command.
+
+$ make server.csr
+
+ You will have to ensure that the certificate contains the XP
+ extensions needed by Microsoft clients.
+
+
+ MAKING A CLIENT CERTIFICATE
+
+
+ Client certificates are used by EAP-TLS, and optionally by EAP-TTLS
+and PEAP. The following steps outline how to create a client
+certificate that is signed by the server certificate created above.
+You will have to have the password for the server certificate in the
+"input_password" and "output_password" fields of the server.cnf file.
+
+
+$ vi client.cnf
+
+ Edit the "input_password" and "output_password" fields to be the
+ password for the client certificate. You will have to give these
+ passwords to the end user who will be using the certificates.
+
+ Edit the [client] section to have the correct values for your
+ country, state, etc. Be sure that the commonName field here is
+ the User-Name that will be used for logins!
+
+$ make client.pem
+
+ The users certificate will be in "emailAddress.pem",
+ i.e. "user@example.com.pem".
+
+ To create another client certificate, just repeat the steps for
+ making a client certificate, being sure to enter a different login
+ name for "commonName", and a different password.
+
+
+ PERFORMANCE
+
+
+ EAP performance for EAP-TLS, TTLS, and PEAP is dominated by SSL
+ calculations. That is, a normal system can handle PAP
+ authentication at a rate of 10k packets/s. However, SSL involves
+ RSA calculations, which are very expensive. To benchmark your system,
+ do:
+
+$ openssl speed rsa
+
+ or
+
+$ openssl speed rsa2048
+
+ to test 2048 bit keys.
+
+ A 1GHz system will likely do 30 calculations/s. A 2GHz system may
+ do 50 calculations/s, or more. That number is also the number of
+ authentications/s that can be done for EAP-TLS (or TTLS, or PEAP).
+
+
+ COMPATIBILITY
+
+The certificates created using this method are known to be compatible
+with ALL operating systems. Some common issues are:
+
+ - Windows requires certain OIDs in the certificates. If it doesn't
+ see them, it will stop doing EAP. The most visible effect is
+ that the client starts EAP, gets a few Access-Challenge packets,
+ and then a little while later re-starts EAP. If this happens, see
+ the FAQ, and the comments in raddb/eap.conf for how to fix it.
+
+ - Windows requires the root certificates to be on the client PC.
+ If it doesn't have them, you will see the same issue as above.
+
+ - Windows XP post SP2 has a bug where it has problems with
+ certificate chains. i.e. if the server certificate is an
+ intermediate one, and not a root one, then authentication will
+ silently fail, as above.
+
+ - Some versions of Windows CE cannot handle 4K RSA certificates.
+ They will (again) silently fail, as above.
+
+ - In none of these cases will Windows give the end user any
+ reasonable error message describing what went wrong. This leads
+ people to blame the RADIUS server. That blame is misplaced.
+
+ - Certificate chains of more than 64K bytes are known to not work.
+ This is a problem in FreeRADIUS. However, most clients cannot
+ handle 64K certificate chains. Most Access Points will shut down
+ the EAP session after about 50 round trips, while 64K certificate
+ chains will take about 60 round trips. So don't use large
+ certificate chains. They will only work after everyone upgrade
+ everything in the network.
+
+ - All other operating systems are known to work with EAP and
+ FreeRADIUS. This includes Linux, *BSD, Mac OS X, Solaris,
+ Symbian, along with all known embedded systems, phones, WiFi
+ devices, etc.
+
+ - Someone needs to ask Microsoft to please stop making life hard for
+ their customers.
+
+
+ SECURITY CONSIDERATIONS
+
+The default certificate configuration files uses MD5 for message
+digests, to maintain compatibility with network equipment that
+supports only this algorithm.
+
+MD5 has known weaknesses and is discouraged in favour of SHA1 (see
+http://www.kb.cert.org/vuls/id/836068 for details). If your network
+equipment supports the SHA1 signature algorithm, we recommend that you
+change the "ca.cnf", "server.cnf", and "client.cnf" files to specify
+the use of SHA1 for the certificates. To do this, change the
+'default_md' entry in those files from 'md5' to 'sha1'.
diff --git a/src/test/setup/radius-config/freeradius/certs_2/bootstrap b/src/test/setup/radius-config/freeradius/certs_2/bootstrap
new file mode 100755
index 0000000..82f93ec
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/bootstrap
@@ -0,0 +1,82 @@
+#!/bin/sh
+#
+# This is a wrapper script to create default certificates when the
+# server first starts in debugging mode. Once the certificates have been
+# created, this file should be deleted.
+#
+# Ideally, this program should be run as part of the installation of any
+# binary package. The installation should also ensure that the permissions
+# and owners are correct for the files generated by this script.
+#
+# $Id: c9d939beac8d5bdc21ea1ff9233442f9ab933297 $
+#
+umask 027
+cd `dirname $0`
+
+make -h > /dev/null 2>&1
+
+#
+# If we have a working "make", then use it. Otherwise, run the commands
+# manually.
+#
+if [ "$?" = "0" ]; then
+ make all
+ exit $?
+fi
+
+#
+# The following commands were created by running "make -n", and edited
+# to remove the trailing backslash, and to add "exit 1" after the commands.
+#
+# Don't edit the following text. Instead, edit the Makefile, and
+# re-generate these commands.
+#
+if [ ! -f dh ]; then
+ openssl dhparam -out dh 1024 || exit 1
+ if [ -e /dev/urandom ] ; then
+ ln -sf /dev/urandom random
+ else
+ date > ./random;
+ fi
+fi
+
+if [ ! -f server.key ]; then
+ openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1
+fi
+
+if [ ! -f ca.key ]; then
+ openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
+fi
+
+if [ ! -f index.txt ]; then
+ touch index.txt
+fi
+
+if [ ! -f serial ]; then
+ echo '01' > serial
+fi
+
+if [ ! -f server.crt ]; then
+ openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
+fi
+
+if [ ! -f server.p12 ]; then
+ openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+fi
+
+if [ ! -f server.pem ]; then
+ openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
+ openssl verify -CAfile ca.pem server.pem || exit 1
+fi
+
+if [ ! -f ca.der ]; then
+ openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
+fi
+
+if [ ! -f client.key ]; then
+ openssl req -new -out client.csr -keyout client.key -config ./client.cnf
+fi
+
+if [ ! -f client.crt ]; then
+ openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
+fi
diff --git a/src/test/setup/radius-config/freeradius/certs_2/ca.cnf b/src/test/setup/radius-config/freeradius/certs_2/ca.cnf
new file mode 100644
index 0000000..37207e8
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/ca.cnf
@@ -0,0 +1,62 @@
+[ ca ]
+default_ca = CA_default
+
+[ CA_default ]
+dir = ./
+certs = $dir
+crl_dir = $dir/crl
+database = $dir/index.txt
+new_certs_dir = $dir
+certificate = $dir/ca.pem
+serial = $dir/serial
+crl = $dir/crl.pem
+private_key = $dir/ca.key
+RANDFILE = $dir/.rand
+name_opt = ca_default
+cert_opt = ca_default
+default_days = 360
+default_crl_days = 300
+default_md = sha1
+preserve = no
+policy = policy_match
+crlDistributionPoints = URI:http://www.example.com/example_ca.crl
+
+[ policy_match ]
+countryName = match
+stateOrProvinceName = match
+organizationName = match
+organizationalUnitName = optional
+commonName = supplied
+emailAddress = optional
+
+[ policy_anything ]
+countryName = optional
+stateOrProvinceName = optional
+localityName = optional
+organizationName = optional
+organizationalUnitName = optional
+commonName = supplied
+emailAddress = optional
+
+[ req ]
+prompt = no
+distinguished_name = certificate_authority
+default_bits = 2048
+input_password = whatever
+output_password = whatever
+x509_extensions = v3_ca
+
+[certificate_authority]
+countryName = US
+stateOrProvinceName = CA
+localityName = Somewhere
+organizationName = Ciena Inc.
+emailAddress = admin@ciena.com
+commonName = "Example Certificate Authority"
+
+[v3_ca]
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer:always
+basicConstraints = CA:true
+crlDistributionPoints = URI:http://www.example.com/example_ca.crl
+
diff --git a/src/test/setup/radius-config/freeradius/certs_2/ca.der b/src/test/setup/radius-config/freeradius/certs_2/ca.der
new file mode 100644
index 0000000..a505cfc
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/ca.der
Binary files differ
diff --git a/src/test/setup/radius-config/freeradius/certs_2/ca.key b/src/test/setup/radius-config/freeradius/certs_2/ca.key
new file mode 100644
index 0000000..f6ce685
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/ca.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQInjXhKnIFIgUCAggA
+MBQGCCqGSIb3DQMHBAh+B3FNG/y9LQSCBMhDZu1kDr0UGMnD8mpB7H319e8GLakT
+8jzPI+bxethA4ZthxY3x5Jxcvyhzy92pR7lCG2Sr8HOVhPpxmp3W5HhbrDhdOj+Q
+qy4Y00G2JCos2wVKTecAOgE5a3i2hDVJDsGxqfwqdohBUwhxVwGDxyzelClN3tNW
+xlj6YuPdUly5tmS1Jo0vtw94QtKk1N0JlNxkTz98vfvgxD4vHqMZugfV2EX2P985
+taRb2bX8VE5rh7CkNhYmYxyv5LACM+7IyM4yvUBfqJG0JPg4UKDVya1dm2mHb7+I
+6C7UcOM7phMZeHNT1gixzSl1UFEtBJaPgmxKIIyBUls7bgKOtNf+BNo+OTWfrnH+
+nvMAoEEPr0GT/fD1tpiR4JaRYXMUHrUt8kGw3Kayr2q9HYJuDeb1uwxK/ml+7aGN
+km9IEV/8Cc0/7TGSQR8jqS+evEy9Sv7tiB2rGnwB6hsbvT+l3jQdv/cX00vMPhRA
+g2KBqifiXRnZnYWlY1KAhZZm0BqJuohYko+xJ2yL2I5q8H7UooN+ND8nsaROOELq
+4FdwJd3MaHEgEnyPL5zFrCcv/R/v1GZNJGt0GT2marwPjLTkGcvDZvbX44a/InyV
+IlYZA/JNmWP6NlABhZIf/mzxnOWPjBwqq2y8Wg2PXpYrumj1nIUoO5B96YYo6lvS
+wlAjIYAxLy8IsUMURDfpvm2CCIW0aGTwO8YSyWnxLBa27MG8fWubjJafm+K4SOf3
+uLiBWlbrkCG7jvNL07/mnkjlP4n05Olb5nrpeTKOz3nklbQmsBhC5/OHZj7ZlUul
+gAR6/U3B0sefMsdqxuls3w8qfgrV1oQGATxvWgYs5zFa/bXBSN1L+brc2q+8ZtgR
+GkFIwnXPWiKB7GIlamER24a1nctR4vL+sYmpmlav+OS6n/jItTCYed+dQ5inC3hX
+4rdGiAjylaTDkW7k4dtIXGUJNGZbIxrpAqNYOVYrCyAEj+HdpNuTUUO2vohq+EM1
+og7SeLhsVg1bG3lYRaqZaXjsof2NAruFJ8aH93DcwoClxFjNJxOd9YAXIA83Uvz8
+D2Bu1/Z41Grq8O7YEnrYbxJP77G9PAgCLt2Uc16O91Lpg1gZ3gESX2BmuR38wbyv
+t5MoC1/oSBV+643yq2ldQRYOMSKl/CLoApywcatdHCIiDC3AEIklueG5jA9Diutl
+ZfK8XSpBEYPQm+eHLdfUOTTnF3SoNPDGbm102nKyvgmGpReFgREYyZSwvg/1YuL/
+m8S+lR+gmP3i9Y4/0UcccI24tO5s0FI4od/4BZ4NW9JsYKxCTj/WJCH4bpmjtmwK
+WI1XSxso1ueVQ7qJBVJyEsMa480nJ5GMKoEfzhqzGzvT1awcz5y/Q/4vIjGZVmR2
+GekRkn9uadPQnIsYGX99A5gPAXP+oCJ9MqLXZPdWLXdm0OybAkD++ryKfi3DNYq2
+TO4hcHLi7lEaIgDcOt+RWTkF0y6yZ3vnY6llvQTRF7fe+6R4YJg0On69+Lt6BoZw
+hmgaaR8YJl++eFWzCJjdJJrCPIiQginbGbpks2Zrz5hGGcQhNwomRX5DFVouePK5
+qhd54Myo2di+Fu0Ls86+nFwnIs9s1+c/2rDWzV1aRfEjnv3OUSLi1saoXjiunMBq
+/L4=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/ca.pem b/src/test/setup/radius-config/freeradius/certs_2/ca.pem
new file mode 100644
index 0000000..916cdf9
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/ca.pem
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEyTCCA7GgAwIBAgIJAM6l2jUG56pLMA0GCSqGSIb3DQEBCwUAMIGLMQswCQYD
+VQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVNvbWV3aGVyZTETMBEGA1UE
+ChMKQ2llbmEgSW5jLjEeMBwGCSqGSIb3DQEJARYPYWRtaW5AY2llbmEuY29tMSYw
+JAYDVQQDEx1FeGFtcGxlIENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0xNjAzMTEx
+ODUzMzVaFw0xNzAzMDYxODUzMzVaMIGLMQswCQYDVQQGEwJVUzELMAkGA1UECBMC
+Q0ExEjAQBgNVBAcTCVNvbWV3aGVyZTETMBEGA1UEChMKQ2llbmEgSW5jLjEeMBwG
+CSqGSIb3DQEJARYPYWRtaW5AY2llbmEuY29tMSYwJAYDVQQDEx1FeGFtcGxlIENl
+cnRpZmljYXRlIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
+ggEBAL9Jv54TkqycL3U2Fdd/y5NXdnPVXwAVV3m6I3eIffVCv8eS+mwlbl9dnbjo
+qqlGEgA3sEg5HtnKoW81l3PSyV/YaqzUzbcpDlgWlbNkFQ3nVxh61gSU34Fc4h/W
+plSvCkwGSbV5udLtEe6S9IflP2Fu/eXa9vmUtoPqDk66p9U/nWVf2H1GJy7XanWg
+wke+HpQvbzoSfPJS0e5Rm9KErrzaIkJpqt7soW+OjVJitUax7h45RYY1HHHlbMQ0
+ndWW8UDsCxFQO6d7nsijCzY69Y8HarH4mbVtqhg3KJevxD9UMRy6gdtPMDZLah1c
+LHRu14ucOK4aF8oICOgtcD06auUCAwEAAaOCASwwggEoMB0GA1UdDgQWBBQwEs0m
+c8HARTVp21wtiwgav5biqjCBwAYDVR0jBIG4MIG1gBQwEs0mc8HARTVp21wtiwga
+v5biqqGBkaSBjjCBizELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIwEAYDVQQH
+EwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5hIEluYy4xHjAcBgkqhkiG9w0BCQEW
+D2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMdRXhhbXBsZSBDZXJ0aWZpY2F0ZSBB
+dXRob3JpdHmCCQDOpdo1BueqSzAMBgNVHRMEBTADAQH/MDYGA1UdHwQvMC0wK6Ap
+oCeGJWh0dHA6Ly93d3cuZXhhbXBsZS5jb20vZXhhbXBsZV9jYS5jcmwwDQYJKoZI
+hvcNAQELBQADggEBAK+fyAFO8CbH35P5mOX+5wf7+AeC+5pwaFcoCV0zlfwniANp
+jISgcIX9rcetLxeYRAO5com3+qLdd9dGVNL0kwufH4QhlSPErG7OLHHAs4JWVhUo
+bH3lK9lgFVlnCDBtQhslzqScR64SCicWcQEjv3ZMZsJwYLvl8unSaKz4+LVPeJ2L
+opCpmZw/V/S2NhBbe3QjTiRPmDev2gbaO4GCfi/6sCDU7UO3o8KryrkeeMIiFIej
+gfwn9fovmpeqCEyupy2JNNUTJibEuFknwx7JAX+htPL27nEgwV1FYtwI3qLiZqkM
+729wo9cFSslJNZBu+GsBP5LszQSuvNTDWytV+qY=
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/client.cnf b/src/test/setup/radius-config/freeradius/certs_2/client.cnf
new file mode 100644
index 0000000..994d3ab
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/client.cnf
@@ -0,0 +1,53 @@
+[ ca ]
+default_ca = CA_default
+
+[ CA_default ]
+dir = ./
+certs = $dir
+crl_dir = $dir/crl
+database = $dir/index.txt
+new_certs_dir = $dir
+certificate = $dir/ca.pem
+serial = $dir/serial
+crl = $dir/crl.pem
+private_key = $dir/ca.key
+RANDFILE = $dir/.rand
+name_opt = ca_default
+cert_opt = ca_default
+default_days = 360
+default_crl_days = 300
+default_md = sha1
+preserve = no
+policy = policy_match
+
+[ policy_match ]
+countryName = match
+stateOrProvinceName = match
+organizationName = match
+organizationalUnitName = optional
+commonName = supplied
+emailAddress = optional
+
+[ policy_anything ]
+countryName = optional
+stateOrProvinceName = optional
+localityName = optional
+organizationName = optional
+organizationalUnitName = optional
+commonName = supplied
+emailAddress = optional
+
+[ req ]
+prompt = no
+distinguished_name = client
+default_bits = 2048
+input_password = whatever
+output_password = whatever
+
+[client]
+countryName = US
+stateOrProvinceName = CA
+localityName = Somewhere
+organizationName = Ciena Inc.
+emailAddress = user@ciena.com
+commonName = user@ciena.com
diff --git a/src/test/setup/radius-config/freeradius/certs_2/client.crt b/src/test/setup/radius-config/freeradius/certs_2/client.crt
new file mode 100644
index 0000000..1197fec
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/client.crt
@@ -0,0 +1,80 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 2 (0x2)
+ Signature Algorithm: sha1WithRSAEncryption
+ Issuer: C=US, ST=CA, L=Somewhere, O=Ciena Inc./emailAddress=admin@ciena.com, CN=Example Certificate Authority
+ Validity
+ Not Before: Mar 11 18:53:36 2016 GMT
+ Not After : Mar 6 18:53:36 2017 GMT
+ Subject: C=US, ST=CA, O=Ciena Inc., CN=user@ciena.com/emailAddress=user@ciena.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (2048 bit)
+ Modulus:
+ 00:ec:5e:99:c0:6c:3e:7f:6d:66:c0:9a:e6:8d:89:
+ 03:ab:10:0c:2e:c0:e8:98:02:35:75:e5:d9:51:73:
+ 28:b3:4d:bc:1f:4f:4b:a0:fb:64:1b:10:e4:09:f4:
+ cc:40:cc:37:38:b9:d6:ae:e5:9e:b6:20:d5:7c:a2:
+ 13:84:bc:17:33:06:00:5a:fd:e1:19:46:31:02:54:
+ 6d:10:fd:57:fa:2a:b3:33:17:e2:4f:be:88:03:8a:
+ b4:80:35:82:bd:f1:ed:98:be:d2:d9:23:55:25:73:
+ 5d:39:a0:36:78:42:84:06:a6:74:cb:23:61:41:b9:
+ f8:26:3d:58:08:9c:5f:2c:be:54:45:77:cd:3a:61:
+ 65:90:d1:3a:37:23:12:9e:26:fd:34:97:54:f6:0f:
+ 81:80:d7:23:8d:18:64:a5:f9:05:db:ea:ca:45:ad:
+ 4f:fb:48:81:96:f8:f1:14:b5:34:fc:8d:fd:79:02:
+ 63:39:77:6e:fd:b5:ab:1e:cc:73:47:dc:11:bb:09:
+ 04:82:11:61:35:24:7f:19:ec:8a:57:27:98:bc:52:
+ 60:ef:a9:f8:36:7d:b8:12:c1:cd:c4:2d:fb:84:5d:
+ e6:92:d2:7e:2d:b5:58:cd:fd:d9:9d:a8:3a:2d:ef:
+ b3:f3:98:00:f0:2a:82:68:b6:25:63:af:de:67:8f:
+ 6b:ff
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Extended Key Usage:
+ TLS Web Client Authentication
+ X509v3 CRL Distribution Points:
+
+ Full Name:
+ URI:http://www.example.com/example_ca.crl
+
+ Signature Algorithm: sha1WithRSAEncryption
+ 2c:1c:cc:3c:34:c8:07:ab:0b:c8:f9:74:4f:a2:55:32:33:a4:
+ ca:57:40:56:15:d6:89:0b:13:8d:a1:90:18:95:14:7b:57:26:
+ 50:9c:99:6d:46:44:73:5d:cc:ca:05:cc:3c:e3:38:c7:bc:fa:
+ 56:95:c6:ba:ad:5c:fd:5c:67:57:34:36:7c:d9:db:25:c2:00:
+ 1e:2f:fb:1b:c5:b9:fd:24:1f:3d:eb:08:54:3b:07:4c:47:38:
+ 66:ca:4f:8b:98:e5:4b:f3:15:5f:71:ce:0b:e0:43:6c:e8:dd:
+ 6f:0a:8f:45:7d:09:12:bf:ae:3b:28:63:3b:e9:51:c4:6f:22:
+ 94:c4:40:0a:80:54:6f:0d:5e:0e:e5:43:a0:40:60:12:b4:94:
+ 0b:8e:29:ab:98:a8:0f:0d:b1:7a:57:3e:63:a8:50:76:6b:58:
+ c1:f6:34:0d:bb:f0:c4:7b:40:e3:de:5f:ac:bc:8f:71:ab:2d:
+ 0e:24:ff:ce:b7:bb:34:be:75:33:25:03:3e:38:d8:8e:08:4d:
+ 40:4c:2f:bb:ae:88:29:b4:37:4f:5b:49:06:b8:08:ef:f5:88:
+ f9:da:a1:28:11:68:94:a1:8a:4c:35:88:1e:c6:57:42:f6:75:
+ b2:71:ae:fc:54:58:ce:0d:65:f9:1f:e3:4f:c7:11:07:d0:43:
+ c2:15:2d:ca
+-----BEGIN CERTIFICATE-----
+MIIDvTCCAqWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM2WhcN
+MTcwMzA2MTg1MzM2WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAOxemcBsPn9tZsCa5o2JA6sQDC7A6JgCNXXl2VFzKLNNvB9PS6D7ZBsQ
+5An0zEDMNzi51q7lnrYg1XyiE4S8FzMGAFr94RlGMQJUbRD9V/oqszMX4k++iAOK
+tIA1gr3x7Zi+0tkjVSVzXTmgNnhChAamdMsjYUG5+CY9WAicXyy+VEV3zTphZZDR
+OjcjEp4m/TSXVPYPgYDXI40YZKX5BdvqykWtT/tIgZb48RS1NPyN/XkCYzl3bv21
+qx7Mc0fcEbsJBIIRYTUkfxnsilcnmLxSYO+p+DZ9uBLBzcQt+4Rd5pLSfi21WM39
+2Z2oOi3vs/OYAPAqgmi2JWOv3mePa/8CAwEAAaNPME0wEwYDVR0lBAwwCgYIKwYB
+BQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5leGFtcGxlLmNvbS9l
+eGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOCAQEALBzMPDTIB6sLyPl0T6JV
+MjOkyldAVhXWiQsTjaGQGJUUe1cmUJyZbUZEc13MygXMPOM4x7z6VpXGuq1c/Vxn
+VzQ2fNnbJcIAHi/7G8W5/SQfPesIVDsHTEc4ZspPi5jlS/MVX3HOC+BDbOjdbwqP
+RX0JEr+uOyhjO+lRxG8ilMRACoBUbw1eDuVDoEBgErSUC44pq5ioDw2xelc+Y6hQ
+dmtYwfY0DbvwxHtA495frLyPcastDiT/zre7NL51MyUDPjjYjghNQEwvu66IKbQ3
+T1tJBrgI7/WI+dqhKBFolKGKTDWIHsZXQvZ1snGu/FRYzg1l+R/jT8cRB9BDwhUt
+yg==
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/client.csr b/src/test/setup/radius-config/freeradius/certs_2/client.csr
new file mode 100644
index 0000000..8f8a518
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/client.csr
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICwDCCAagCAQAwezELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRIwEAYDVQQH
+EwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5hIEluYy4xHTAbBgkqhkiG9w0BCQEW
+DnVzZXJAY2llbmEuY29tMRcwFQYDVQQDFA51c2VyQGNpZW5hLmNvbTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOxemcBsPn9tZsCa5o2JA6sQDC7A6JgC
+NXXl2VFzKLNNvB9PS6D7ZBsQ5An0zEDMNzi51q7lnrYg1XyiE4S8FzMGAFr94RlG
+MQJUbRD9V/oqszMX4k++iAOKtIA1gr3x7Zi+0tkjVSVzXTmgNnhChAamdMsjYUG5
++CY9WAicXyy+VEV3zTphZZDROjcjEp4m/TSXVPYPgYDXI40YZKX5BdvqykWtT/tI
+gZb48RS1NPyN/XkCYzl3bv21qx7Mc0fcEbsJBIIRYTUkfxnsilcnmLxSYO+p+DZ9
+uBLBzcQt+4Rd5pLSfi21WM392Z2oOi3vs/OYAPAqgmi2JWOv3mePa/8CAwEAAaAA
+MA0GCSqGSIb3DQEBCwUAA4IBAQB030zqg/C6+0rwf+nsdQJvpUGFVCT3WJRf7Qx5
+NC3n6hfetLHs7XjPZ77CI2B1VEPE7r55Mv1m81b1+2WO/jFQXlM52CteOSLy/Zsj
+lUBW4naaCa+C3liOn1cSONNClvKMGl2DcTbOFO8j9A3dAOHUR05SeAtGutVip9CS
+NPl36MmwFUO0p25UkmG4IJIZPVaMEjqEPVjWxnRFrajFwsbyMkHEFIEvQ/TP1qpN
+LzLmp+Y4flS4O7zC3AAt4Zayr4AC5cf4JKDJxxfZ+qE0KS7jV4bJdo5hxpGz4ECC
+/LDZPZN9oGr67bNSjM4+Ogdx5v4Huojn/lQPK4gTME8SIUPX
+-----END CERTIFICATE REQUEST-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/client.key b/src/test/setup/radius-config/freeradius/certs_2/client.key
new file mode 100644
index 0000000..a2e92c3
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/client.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIY2/Sy6WJDBYCAggA
+MBQGCCqGSIb3DQMHBAgzT2/EDIfXJASCBMjE2epab8bFXVgs1E2P02G/LzexUvvO
+gH9GltVbzVSmsuWNKaGBqWvRNiKrIiGIBQpNZsdV/0ae/5Etw3qkvcO/vTiPAOgC
+3+vkaNZMIpI4jePvvCzeUlnybg4+WBq6aXZLRQc8uCWkApH/HfcnwxCKEKebPqj5
+F1xmzT8WOSRJYytrwzU7GWQtsDwFCv0KnTJeYni9CVLIX8jFLtMB1mRhYZ93eSiM
+DjsSr2OH/AOiZQEzCv5YMbDk4WD9L1MD5S62bpWxdwG/aEr8E1dI1Z2TJHzx75dR
+lWdoV1BQHfKmsQRtwnZ/Hq6zmzY+SStJGFUcRdBdLdJrfRcIyTJXVkFYoVMM/PDl
+UT4K0pIcDILH7jPNp7kuDfSDigFNvqk4O6GybN+TT7cQKH5oGtEsvGSOfUYZUEvp
+KV4rpyR+n3NPC1tEoOvfuGlqHDGN62pdTVhFM/FqFbZSEoTzlSU+OecLiQrGtS6T
+hrmWt/go20MxTlWh87L0s9SRalP4A2YkufHBst8oSgwI4DzVhifqqWD87w7iL0Ur
+6drgbtlM2hY3onkwS2+oSzEIIlwLwaBaAt2hnVosgZIQajcmlayIhRQ1SNsYYj2T
+YTTTYxPWwUaIYzOl7Ri1OoD5dSFY84sUAD7odLMpzmEJQIi31KYIdOs1BN5oDpFV
+GbcKtF7sKw2QBb8nZgADobpCHIJIG/SLNqx4UgSZYgLVUgW0xaS8+8ylVLqRkIjM
+yoGkxqezc2pvCAbH8BMGYaZei5TL9GHanae+t6caBK9Zty6m9bdT9H9EkC6NEWhX
+IuKGZjyq/+O1mFK/66ts+tq9mynyZfVxxAKINijGLEWKPL0KAZkZIfFnCfXO7kK/
+JJNp5zE8GX9FFT5w8sq2UTsfS/F6K8kih+gZVJtj4irnWiABLq4VQjBRPeJJFt5Q
+Zki48dH5JP1/0222mka+ynRfv6pAtSN1Y5vx2mDPNoxiajhfMoLAxFkwwUYA3AfI
+DMTByk7n27HfWtmkUV+Zx263NVkCU0/BjOE3j7N1OojSuCizJRIT199hRhmnTFoy
+FPRrmYF4g/HU1ca6u8If5JzZAfJIqN8H9oHHTdWg5HuU31NpQPHgQqRGvaaBpuwc
+oglzg6mhl/4dUlZiw6l7bJGMojid24iTMgt6FkUqma1ECQ2wp3SF06u7iFecB78B
+aKJhOGOF1GHc0DMHNwLfSw1wIBah5K1SFm4JQyEYrG/KeRGXRKKGlKPGTKQPQRCU
+LCqbWnFMPBW5b/V/Xv02BBemgwp44RsFDQo6AVp6zbzWwh84oLrFSuGMK7aGynGA
+/MzGAmrC5jbIC62WAejlSj51o6sHoQNjn59PULZWqsbfD0DWH1DXeGqzLNd0phx7
+v1yDjLVq7J64YNYtxctZ+G54Pkg5wHTyx+dt3gKi/wVSc/cOHNDC2QxWhvSxL0cp
+/QpgggxaADcPZkvQe2/34wbqBTYbz9j+PODuad8hrqSLMLzX5iIFqE8qOYNPwH8z
+Lz66G4k3kp307/+0pocIRASn9dtX0PgpGyKo1hvg3zYNP+ObRPOT06Zx1HhEIx2S
+7oQXaQNDJpZd5tO+s7RY80ficybUe7wC4BnqNaoxVluBaIEA2NdiPHOiL5Sh0sme
+0oI=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/client.p12 b/src/test/setup/radius-config/freeradius/certs_2/client.p12
new file mode 100644
index 0000000..d1289a9
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/client.p12
Binary files differ
diff --git a/src/test/setup/radius-config/freeradius/certs_2/client.pem b/src/test/setup/radius-config/freeradius/certs_2/client.pem
new file mode 100644
index 0000000..6dc7d9b
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/client.pem
@@ -0,0 +1,60 @@
+Bag Attributes
+ localKeyID: 8F EF 1A 9E BD 4E 8D A1 8E 01 DF AF D0 5A 74 29 F5 76 99 DB
+subject=/C=US/ST=CA/O=Ciena Inc./CN=user@ciena.com/emailAddress=user@ciena.com
+issuer=/C=US/ST=CA/L=Somewhere/O=Ciena Inc./emailAddress=admin@ciena.com/CN=Example Certificate Authority
+-----BEGIN CERTIFICATE-----
+MIIDvTCCAqWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM2WhcN
+MTcwMzA2MTg1MzM2WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAOxemcBsPn9tZsCa5o2JA6sQDC7A6JgCNXXl2VFzKLNNvB9PS6D7ZBsQ
+5An0zEDMNzi51q7lnrYg1XyiE4S8FzMGAFr94RlGMQJUbRD9V/oqszMX4k++iAOK
+tIA1gr3x7Zi+0tkjVSVzXTmgNnhChAamdMsjYUG5+CY9WAicXyy+VEV3zTphZZDR
+OjcjEp4m/TSXVPYPgYDXI40YZKX5BdvqykWtT/tIgZb48RS1NPyN/XkCYzl3bv21
+qx7Mc0fcEbsJBIIRYTUkfxnsilcnmLxSYO+p+DZ9uBLBzcQt+4Rd5pLSfi21WM39
+2Z2oOi3vs/OYAPAqgmi2JWOv3mePa/8CAwEAAaNPME0wEwYDVR0lBAwwCgYIKwYB
+BQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5leGFtcGxlLmNvbS9l
+eGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOCAQEALBzMPDTIB6sLyPl0T6JV
+MjOkyldAVhXWiQsTjaGQGJUUe1cmUJyZbUZEc13MygXMPOM4x7z6VpXGuq1c/Vxn
+VzQ2fNnbJcIAHi/7G8W5/SQfPesIVDsHTEc4ZspPi5jlS/MVX3HOC+BDbOjdbwqP
+RX0JEr+uOyhjO+lRxG8ilMRACoBUbw1eDuVDoEBgErSUC44pq5ioDw2xelc+Y6hQ
+dmtYwfY0DbvwxHtA495frLyPcastDiT/zre7NL51MyUDPjjYjghNQEwvu66IKbQ3
+T1tJBrgI7/WI+dqhKBFolKGKTDWIHsZXQvZ1snGu/FRYzg1l+R/jT8cRB9BDwhUt
+yg==
+-----END CERTIFICATE-----
+Bag Attributes
+ localKeyID: 8F EF 1A 9E BD 4E 8D A1 8E 01 DF AF D0 5A 74 29 F5 76 99 DB
+Key Attributes: <No Attributes>
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI6qtqDG5BZo0CAggA
+MBQGCCqGSIb3DQMHBAi1fAR8FIi0cgSCBMjz9+X+jT+0Bop2xt6SN0SHb/zqlDKP
+Ca1mvOp0+hbID9/lZ4uh71QhxwFnEp/Vnoz2Shxavb75SQKNBVWuazsiJogrFfTj
+d/3PLlTpyIheFLpBkh95Gt4103ON4wPDh2g6j8hpEJoBy4qxb4C8FrWJ05LYjONI
+Uz+zlAn6v2pWkep/kLijb9hCyBjlVRECdArwL/Y7KzFwiGGJX+FtDABrZKfHZw7l
+ovgPQE/7bSG8/8clJ+1IM1AWTFqxpvnj66lWh/DMfoAvNKH45lpGvkbNy9UHIJsu
+1fYyeGibGSisGuLCvsojt/Idmz2O/zU1suv8/ZVV3vRWe+FpUUZqC1rVTKA+BVyy
+vWiFi3u0tezWNiey0y7ocFxIv5+PDH87cG54xRfwQIgDB4QAdcaJpmA4pkU7puhS
+gv54wcAxLRhQGy4lVOiqBkIVzux0m12L/Jh6Ctl8EfYMrrdQeBZMAVtC/qLgv2O4
+cJWVzD69lveMNOekLswaOzKVxwpe2jFeWf9TsDpV1+r+sYcT3b9xHmo7gHLH/Vu5
+RcIRD6QFBKyt8lvqNUSysDA8GnRcw/AInrfaLz7Nly768gkSjMLd1EByCraX8GaD
+8RPl8thtjqbfoC/j2+UjYQw79QnxOia2K0Ft3aXh40YTMQqXDZuoPR3ajaS4Fyz5
+nxnctUtk0i85p8Ge4V3pMZCC6EZdTrzgKv8GvFJLzmy7vfTbJBapK8LlwUJMWyyv
+aED55kkv2lhjPT/Qy4iz5j9/Q5DgEENEB42x0SDK8fjTGZ8vrIEp7kzPMYuqpFZ8
+XFiwHB4brrpq7gxyedG7FbzWqO+t3xSvgXRYDj7WKMUPZXw7QGvGNci2U7GiPVM1
+vPCpIllgh2ZJ9p1vvf44o6Aoh2i4Hkl24zRTSV5L4c5yu8Eeckj6lJubTSlrfa2d
+aEIyO6SK3jgXJKXl70Xv4jAe5M5JDkK85k9HAXQryceWi8dpuHfNb9akFX8vMymh
+QCd2QzROyAytHGAPgH/55hHIg93ORkpMA9GzsutH9+u14uziSpbr3B3j8uOgKTnN
+U+rrEKP9Wm23efJ/X5IzEfFPeGqG4dZDOn9US/WkwiTNFmy834T89DRT609ckSVD
+AhAlQVOXLE2gp/0i+b2vdT1Br+PRqQOXh0sv9x6uL56tvuUG3nnOWGZSljZmEm5p
+Qa8JSjY3ZDn6KC1FJyk4DTf7U38zTi2Z/+AL8K680zEJ6Uc9HI3wVdd19Cf84RdQ
+T6fD/LkvBAWTHzVxMrxYVPqE/3Sf1AJX0cmzciZhxrCml4RQZ78i98/yJaxo7ql7
+0Q34+KaAXHP1QghjmXBERBcyHgNeV/jUUXsxZA/MCkn7PvtCuHkNqc2ZlmN0hLwz
+ObHOo826krBRSlpn7P3DreEjSxzCxPpUXAn6f6bXhtVVIiy6ITkWWfVoLD1/crTc
+sRZMi/EKkmgfIzgCYt3JzAdoii3D7ebxcvfVThbDguOE78OhKY3n4wyJ+FpUn56j
+VcX6Ckl2hAE9qwRNOi383+35A0iUb+vF7ky3K/xMONog+dwdTRkhDbz6rTlO72Tj
+B9xcVJAbopB90NNfrG7LRD472O+t+53C27tG1kyIOaCvXPmeFwgTcLLVjDAyFzXb
+uGo=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/dh b/src/test/setup/radius-config/freeradius/certs_2/dh
new file mode 100644
index 0000000..e7b4f90
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/dh
@@ -0,0 +1,5 @@
+-----BEGIN DH PARAMETERS-----
+MIGHAoGBAKHERxCGYaLWD6ay09DuGxxs5whd4zFUS1pjA7jEvGwnbISSzGvzRbYi
+ymNeNgzrZhHiWo5GC008yLvUy0qxVMny0x+7xybup+mOv6ITEz+HuhlsBN+Aqc5P
+Oyq7h1qnuy8UiiEP87YcwhCFooQ3I8dCcMT7AVApYex4K81Sck/LAgEC
+-----END DH PARAMETERS-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/fef12f18.0 b/src/test/setup/radius-config/freeradius/certs_2/fef12f18.0
new file mode 120000
index 0000000..e375f5a
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/fef12f18.0
@@ -0,0 +1 @@
+ca.pem
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_2/index.txt b/src/test/setup/radius-config/freeradius/certs_2/index.txt
new file mode 100644
index 0000000..27c2c7a
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/index.txt
@@ -0,0 +1,2 @@
+V 170306185335Z 01 unknown /C=US/ST=CA/O=Ciena Inc./CN=Example Server Certificate/emailAddress=admin@ciena.com
+V 170306185336Z 02 unknown /C=US/ST=CA/O=Ciena Inc./CN=user@ciena.com/emailAddress=user@ciena.com
diff --git a/src/test/setup/radius-config/freeradius/certs_2/index.txt.attr b/src/test/setup/radius-config/freeradius/certs_2/index.txt.attr
new file mode 100644
index 0000000..8f7e63a
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/index.txt.attr
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/src/test/setup/radius-config/freeradius/certs_2/index.txt.attr.old b/src/test/setup/radius-config/freeradius/certs_2/index.txt.attr.old
new file mode 100644
index 0000000..8f7e63a
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/index.txt.attr.old
@@ -0,0 +1 @@
+unique_subject = yes
diff --git a/src/test/setup/radius-config/freeradius/certs_2/index.txt.old b/src/test/setup/radius-config/freeradius/certs_2/index.txt.old
new file mode 100644
index 0000000..f0ce0ce
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/index.txt.old
@@ -0,0 +1 @@
+V 170306185335Z 01 unknown /C=US/ST=CA/O=Ciena Inc./CN=Example Server Certificate/emailAddress=admin@ciena.com
diff --git a/src/test/setup/radius-config/freeradius/certs_2/random b/src/test/setup/radius-config/freeradius/certs_2/random
new file mode 120000
index 0000000..a222f14
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/random
@@ -0,0 +1 @@
+/dev/urandom
\ No newline at end of file
diff --git a/src/test/setup/radius-config/freeradius/certs_2/serial b/src/test/setup/radius-config/freeradius/certs_2/serial
new file mode 100644
index 0000000..75016ea
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/serial
@@ -0,0 +1 @@
+03
diff --git a/src/test/setup/radius-config/freeradius/certs_2/serial.old b/src/test/setup/radius-config/freeradius/certs_2/serial.old
new file mode 100644
index 0000000..9e22bcb
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/serial.old
@@ -0,0 +1 @@
+02
diff --git a/src/test/setup/radius-config/freeradius/certs_2/server.cnf b/src/test/setup/radius-config/freeradius/certs_2/server.cnf
new file mode 100644
index 0000000..444372d
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/server.cnf
@@ -0,0 +1,54 @@
+[ ca ]
+default_ca = CA_default
+
+[ CA_default ]
+dir = ./
+certs = $dir
+crl_dir = $dir/crl
+database = $dir/index.txt
+new_certs_dir = $dir
+certificate = $dir/server.pem
+serial = $dir/serial
+crl = $dir/crl.pem
+private_key = $dir/server.key
+RANDFILE = $dir/.rand
+name_opt = ca_default
+cert_opt = ca_default
+default_days = 360
+default_crl_days = 300
+default_md = sha1
+preserve = no
+policy = policy_match
+
+[ policy_match ]
+countryName = match
+stateOrProvinceName = match
+organizationName = match
+organizationalUnitName = optional
+commonName = supplied
+emailAddress = optional
+
+[ policy_anything ]
+countryName = optional
+stateOrProvinceName = optional
+localityName = optional
+organizationName = optional
+organizationalUnitName = optional
+commonName = supplied
+emailAddress = optional
+
+[ req ]
+prompt = no
+distinguished_name = server
+default_bits = 2048
+input_password = whatever
+output_password = whatever
+
+[server]
+countryName = US
+stateOrProvinceName = CA
+localityName = Somewhere
+organizationName = Ciena Inc.
+emailAddress = admin@ciena.com
+commonName = "Example Server Certificate"
+
diff --git a/src/test/setup/radius-config/freeradius/certs_2/server.crt b/src/test/setup/radius-config/freeradius/certs_2/server.crt
new file mode 100644
index 0000000..246df1b
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/server.crt
@@ -0,0 +1,80 @@
+Certificate:
+ Data:
+ Version: 3 (0x2)
+ Serial Number: 1 (0x1)
+ Signature Algorithm: sha1WithRSAEncryption
+ Issuer: C=US, ST=CA, L=Somewhere, O=Ciena Inc./emailAddress=admin@ciena.com, CN=Example Certificate Authority
+ Validity
+ Not Before: Mar 11 18:53:35 2016 GMT
+ Not After : Mar 6 18:53:35 2017 GMT
+ Subject: C=US, ST=CA, O=Ciena Inc., CN=Example Server Certificate/emailAddress=admin@ciena.com
+ Subject Public Key Info:
+ Public Key Algorithm: rsaEncryption
+ Public-Key: (2048 bit)
+ Modulus:
+ 00:a7:9b:3d:b2:8f:6d:dd:55:c7:34:5a:8b:c7:78:
+ a8:ff:14:fa:21:0e:60:1b:0c:87:36:f1:07:3a:cc:
+ f1:8a:9d:23:4c:31:8d:81:92:0b:1f:b2:f9:6f:55:
+ 79:c3:fd:18:8f:99:a7:8b:8c:41:18:a6:02:08:cb:
+ b5:5b:8b:b7:23:a3:6d:20:a9:ec:ee:bf:fa:f1:99:
+ d7:07:35:a1:3b:e9:5e:b7:84:8a:db:5d:46:15:3e:
+ 1f:92:2d:12:db:4c:c3:aa:13:c7:dd:2d:a0:0a:d2:
+ 3c:59:19:fa:7c:d9:a5:b4:16:bd:82:ba:35:47:c4:
+ dc:fb:af:61:f1:70:d8:b3:2c:ef:91:20:c5:d5:af:
+ b7:ac:5d:15:4e:ea:64:ab:0b:b3:ee:25:7e:aa:a8:
+ a0:a5:36:2e:59:ed:b8:c7:02:4f:ab:9b:e7:50:4c:
+ 30:14:4d:48:1a:a2:88:05:6e:7e:82:ef:f8:c5:70:
+ b5:d8:3e:ae:f6:e0:2e:68:ba:52:d3:e5:3a:2d:0f:
+ dd:43:86:39:b5:af:5b:c3:86:7b:98:78:7f:d5:9b:
+ ee:9f:e4:50:5e:03:9e:29:67:f5:78:35:b1:d3:e2:
+ 66:2d:68:36:c2:30:c9:06:c2:1c:73:9b:c3:09:28:
+ ba:08:b8:f5:49:e0:5b:d1:43:d9:38:06:47:32:a2:
+ de:a9
+ Exponent: 65537 (0x10001)
+ X509v3 extensions:
+ X509v3 Extended Key Usage:
+ TLS Web Server Authentication
+ X509v3 CRL Distribution Points:
+
+ Full Name:
+ URI:http://www.example.com/example_ca.crl
+
+ Signature Algorithm: sha1WithRSAEncryption
+ 58:cd:50:ef:5f:b1:3e:34:a2:5d:f4:59:f6:11:25:be:de:b2:
+ f8:58:81:2a:89:f0:e7:df:36:88:49:8e:d2:c4:44:22:6c:40:
+ a4:13:6c:8c:15:9d:f2:9e:32:29:ff:31:f0:82:92:3e:93:58:
+ ce:eb:da:9b:19:76:7d:de:54:c5:b1:b2:2e:66:4c:7b:7c:9c:
+ 98:12:f9:20:aa:d3:c7:d3:0b:70:5a:c3:24:d7:b9:92:8e:38:
+ fe:54:21:c6:c9:e4:c8:b8:b6:ae:8a:0e:2d:18:95:53:da:b6:
+ 9b:94:12:0d:68:e8:ef:0a:78:8b:29:cc:0f:59:a4:d8:dc:6c:
+ 34:b2:7a:6f:de:63:1e:e1:03:d2:f3:ca:b6:26:05:f4:22:51:
+ 2a:ff:78:d1:07:b3:e7:7e:ab:68:33:2a:0a:d0:cc:be:26:ea:
+ 6a:6e:10:d7:2b:7a:7b:cb:e6:0d:50:66:7f:9a:33:31:ad:8d:
+ 1b:3b:3f:8e:74:29:3d:07:37:9d:4d:29:ad:b6:cc:84:d8:1c:
+ 09:48:61:ce:67:30:ee:74:25:fe:23:5a:8d:00:f6:1a:5d:de:
+ 04:70:a7:ea:e9:6f:b0:25:10:f4:3a:70:ab:5a:57:5f:53:12:
+ d8:0e:52:f4:f2:f5:dc:25:71:e5:46:24:09:65:95:22:1b:35:
+ 8b:78:9b:6f
+-----BEGIN CERTIFICATE-----
+MIIDyjCCArKgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM1WhcN
+MTcwMzA2MTg1MzM1WjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xIzAhBgNVBAMTGkV4YW1wbGUgU2VydmVyIENlcnRpZmlj
+YXRlMR4wHAYJKoZIhvcNAQkBFg9hZG1pbkBjaWVuYS5jb20wggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCnmz2yj23dVcc0WovHeKj/FPohDmAbDIc28Qc6
+zPGKnSNMMY2BkgsfsvlvVXnD/RiPmaeLjEEYpgIIy7Vbi7cjo20gqezuv/rxmdcH
+NaE76V63hIrbXUYVPh+SLRLbTMOqE8fdLaAK0jxZGfp82aW0Fr2CujVHxNz7r2Hx
+cNizLO+RIMXVr7esXRVO6mSrC7PuJX6qqKClNi5Z7bjHAk+rm+dQTDAUTUgaoogF
+bn6C7/jFcLXYPq724C5oulLT5TotD91Dhjm1r1vDhnuYeH/Vm+6f5FBeA54pZ/V4
+NbHT4mYtaDbCMMkGwhxzm8MJKLoIuPVJ4FvRQ9k4Bkcyot6pAgMBAAGjTzBNMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly93d3cu
+ZXhhbXBsZS5jb20vZXhhbXBsZV9jYS5jcmwwDQYJKoZIhvcNAQEFBQADggEBAFjN
+UO9fsT40ol30WfYRJb7esvhYgSqJ8OffNohJjtLERCJsQKQTbIwVnfKeMin/MfCC
+kj6TWM7r2psZdn3eVMWxsi5mTHt8nJgS+SCq08fTC3BawyTXuZKOOP5UIcbJ5Mi4
+tq6KDi0YlVPatpuUEg1o6O8KeIspzA9ZpNjcbDSyem/eYx7hA9LzyrYmBfQiUSr/
+eNEHs+d+q2gzKgrQzL4m6mpuENcrenvL5g1QZn+aMzGtjRs7P450KT0HN51NKa22
+zITYHAlIYc5nMO50Jf4jWo0A9hpd3gRwp+rpb7AlEPQ6cKtaV19TEtgOUvTy9dwl
+ceVGJAlllSIbNYt4m28=
+-----END CERTIFICATE-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/server.csr b/src/test/setup/radius-config/freeradius/certs_2/server.csr
new file mode 100644
index 0000000..d055b9e
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/server.csr
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICzjCCAbYCAQAwgYgxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTESMBAGA1UE
+BxMJU29tZXdoZXJlMRMwEQYDVQQKEwpDaWVuYSBJbmMuMR4wHAYJKoZIhvcNAQkB
+Fg9hZG1pbkBjaWVuYS5jb20xIzAhBgNVBAMTGkV4YW1wbGUgU2VydmVyIENlcnRp
+ZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp5s9so9t3VXH
+NFqLx3io/xT6IQ5gGwyHNvEHOszxip0jTDGNgZILH7L5b1V5w/0Yj5mni4xBGKYC
+CMu1W4u3I6NtIKns7r/68ZnXBzWhO+let4SK211GFT4fki0S20zDqhPH3S2gCtI8
+WRn6fNmltBa9gro1R8Tc+69h8XDYsyzvkSDF1a+3rF0VTupkqwuz7iV+qqigpTYu
+We24xwJPq5vnUEwwFE1IGqKIBW5+gu/4xXC12D6u9uAuaLpS0+U6LQ/dQ4Y5ta9b
+w4Z7mHh/1Zvun+RQXgOeKWf1eDWx0+JmLWg2wjDJBsIcc5vDCSi6CLj1SeBb0UPZ
+OAZHMqLeqQIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBAI4JSSggafFTzjYU4n9s
+lKYCCy8+MQ2X9eEKcsBwDiPvXmJdeWJTFYfBHE5p6spyA3IULxb9N90Kajdf287L
+e1Gurh4XuLd2gv/UAR4fpYJ6r0jJviWAe77R1cuJ+QvQWOaSWzJmxtZkO7OdBl0A
+XmksiRLnKu0mGEcGSQQ3vfdwDTGqpfLuSn9U6B8FoK7AjkeB1oKf6UgHnbN01UKp
+ubExjX4lNHLLiNrXjBkyDpW5zBbbhEaPdnDLHvNnd6fTkd7F3Jt5timmrm9hKMMB
+hE7qLyiBoSdqFejZEPjcvJGV42sNetREqIrWnvsXrox+7P+5z8+uowebLXGohfJC
+hmc=
+-----END CERTIFICATE REQUEST-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/server.key b/src/test/setup/radius-config/freeradius/certs_2/server.key
new file mode 100644
index 0000000..63be1bd
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/server.key
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI9q05vTmS4WYCAggA
+MBQGCCqGSIb3DQMHBAi4iVH6BL89ZQSCBMiK+P9gWMj1xFZqEQZ/VUTB0bt6YM8q
+nc1otC9KdWVCl5zqdV3vC0BdLMGv3Xem+u/ycWyrSsqDD3RzFqIjIxJTsAQRMKwr
+Fu4sNBMyAh0TCzVtf73QjiRg8Jtkf4UbTfJzNo1J3rjglnkSJ+9rCAYT4Ei84opN
+T/pdlhw9uRRsz7v+HRzajcpyw6FxtjLOUI2PaG8Lyrlrgt6uP1PvurK2+jexZ8o6
+OWIo5kbrn/rpzTiHWNgRoWnT71J5/lXE8hkjtv/5WAuncPAaUVdo0nKg58RD66St
+MOfQKlISeOdNw0yUWNPKkr98Tnp+fSUFHV4NCpMoV7mgab16grd8XR4qnOYuq8Ay
+9m0kzvffeASJj9hmpRDrZGrPXijNCRtEE8WQv3tLAYRaH180m6qCr7cOCS89LZZ4
+sVEIiAsOgCuAX3E3PGrdFbsGR6MnRpoHNxtUkD5g/b//8HTJ7b0EMKp00VTuHQRH
+JxxTZnbPSmsHJ+RmKL1K3eHqCDXuTPVFdDh82mabd/EiSdfj13+8etMQrF62XhDw
+r/2ElsO1yIPkXg9+FuC67EIBkYEbpuCXkvqYeuYEskEtoSDCj5yoX/aNJUkVImA3
+zveRCH8GMD0kaIf9IQdQ1jJxUGc3ZWFo6MIFAUD5eGXfwWX1x11sFJP2uBdf+31A
+0GhFICUaziHcDrHtqp5/nzo8f0hh+y3zXLx/Mf+WMC0Nirh7nyMoEmeNufYZtdvI
+5u90rYiPr7yS8vQD1R0LQZnODmtx0akn9HAtFvGzFbfa6x+2RoPpDiKS43ZCQPeW
+8JhWakNKijzfl2vufVUtSDZ5cPg5oyTH2NMw+DAgxqowtPmYV9J+ecZ9akwKk1Uz
+cLpNPrDmdUCyfztU5tlfTIdduafj9eIIgvVZs9wajlEWvooMW7cwbKYA0I5wYdq2
+lqFvnJtngUuvykYPFLg/ME+bXbdmQ6M91HpxOqUKp1feX4TW6yDlStpA40vPO3iB
+HmfL1DW3O4JTmvBwdoLPYoL5vP3/st51vXMXUcnyjHAzCa4HXj80PWyBsCM6S/iT
+SJtieMXSLw7R30D5boXncQS/fBCsdJpEpz2GyjJUn2RLbYJ3OsQbXB0eCaL7y9LL
+hGVK5Ez/HWjZ7Q6WRotVjeO5yRIgzWe4VRV58CVOH2CIkf1ODolzhREyzSBCGD6Q
+5rOZSAd21aStrNWQ02nYPXZbcnTo1LQImonSQ4SJZg0lsRSHfahmXkKafyYg5U8E
+jiff1uzSWWtmSZkY46S4dzQOZsY97k8cChliSnY1Jk8mh/5D9ehLxalUNMv0DIN/
+yTgYmC1TasTdchkSZdEyli8xvGWcmMKC+A5ycfRyE2mPxuEL6nQq4MAH7Yie9g7T
+Fzamniy0SXT08yXu2oFhi7VLyxSbGvIBQqE06rh2NVgt+N1eRSa/SJlkB6iqEmEA
+X+4b3D3s+ST6bZ19b6PP1t4tbfpGZ3LGezndpY4GqgfsUi5hdQcdfRjknCyFRZKm
+Qqi43ojk1xsdUHt/q0Y4RFHMtR5oQTapRXybQBRbzS7KCiRsH356ACowvV0UCNg2
+WzfFm3uozQO6NJCfWePdkfVrxU0p4q9s9QxxDX5SApQpqcwt0rJiDOzXvxKH8jx6
+qHo=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/server.p12 b/src/test/setup/radius-config/freeradius/certs_2/server.p12
new file mode 100644
index 0000000..352d346
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/server.p12
Binary files differ
diff --git a/src/test/setup/radius-config/freeradius/certs_2/server.pem b/src/test/setup/radius-config/freeradius/certs_2/server.pem
new file mode 100644
index 0000000..b8b70f5
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/server.pem
@@ -0,0 +1,60 @@
+Bag Attributes
+ localKeyID: 59 6E 27 68 23 9E 59 B9 D8 DD B4 FC 7B 78 89 F7 50 02 A7 A7
+subject=/C=US/ST=CA/O=Ciena Inc./CN=Example Server Certificate/emailAddress=admin@ciena.com
+issuer=/C=US/ST=CA/L=Somewhere/O=Ciena Inc./emailAddress=admin@ciena.com/CN=Example Certificate Authority
+-----BEGIN CERTIFICATE-----
+MIIDyjCCArKgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM1WhcN
+MTcwMzA2MTg1MzM1WjB0MQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xIzAhBgNVBAMTGkV4YW1wbGUgU2VydmVyIENlcnRpZmlj
+YXRlMR4wHAYJKoZIhvcNAQkBFg9hZG1pbkBjaWVuYS5jb20wggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQCnmz2yj23dVcc0WovHeKj/FPohDmAbDIc28Qc6
+zPGKnSNMMY2BkgsfsvlvVXnD/RiPmaeLjEEYpgIIy7Vbi7cjo20gqezuv/rxmdcH
+NaE76V63hIrbXUYVPh+SLRLbTMOqE8fdLaAK0jxZGfp82aW0Fr2CujVHxNz7r2Hx
+cNizLO+RIMXVr7esXRVO6mSrC7PuJX6qqKClNi5Z7bjHAk+rm+dQTDAUTUgaoogF
+bn6C7/jFcLXYPq724C5oulLT5TotD91Dhjm1r1vDhnuYeH/Vm+6f5FBeA54pZ/V4
+NbHT4mYtaDbCMMkGwhxzm8MJKLoIuPVJ4FvRQ9k4Bkcyot6pAgMBAAGjTzBNMBMG
+A1UdJQQMMAoGCCsGAQUFBwMBMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly93d3cu
+ZXhhbXBsZS5jb20vZXhhbXBsZV9jYS5jcmwwDQYJKoZIhvcNAQEFBQADggEBAFjN
+UO9fsT40ol30WfYRJb7esvhYgSqJ8OffNohJjtLERCJsQKQTbIwVnfKeMin/MfCC
+kj6TWM7r2psZdn3eVMWxsi5mTHt8nJgS+SCq08fTC3BawyTXuZKOOP5UIcbJ5Mi4
+tq6KDi0YlVPatpuUEg1o6O8KeIspzA9ZpNjcbDSyem/eYx7hA9LzyrYmBfQiUSr/
+eNEHs+d+q2gzKgrQzL4m6mpuENcrenvL5g1QZn+aMzGtjRs7P450KT0HN51NKa22
+zITYHAlIYc5nMO50Jf4jWo0A9hpd3gRwp+rpb7AlEPQ6cKtaV19TEtgOUvTy9dwl
+ceVGJAlllSIbNYt4m28=
+-----END CERTIFICATE-----
+Bag Attributes
+ localKeyID: 59 6E 27 68 23 9E 59 B9 D8 DD B4 FC 7B 78 89 F7 50 02 A7 A7
+Key Attributes: <No Attributes>
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIQUZafKqU+44CAggA
+MBQGCCqGSIb3DQMHBAhxfosFDCxaJwSCBMhbvtkYjR1vowEixVQS2J5vL4EhHv7x
+ImI1vnLIbjY6HmUGuOolLidZQ7ieG1hrElat3gPCgw7zfmZyS3DOnLTxBAZRlOxK
+3zkBnegVGNbOnnsLJJX52JSDJvGnlUPWg3r8UhFp3aPH1eqUyt0bTySgpsSdt3yD
+/oWymM1bQW65KfKW3cskR+oKyqjh4rQevyTf5dR2r4noVfR96RqdJWJ95ag40GXN
+gpLDBTZD+iuMN1PiH9CraJWbRIWQOM0ieC79wGZ57V5tzgHENNey2itgwJ93iCj0
+Ay4f0HUEOuqJ7kK1fYEo+MUBt5TzpLBygGIVgbusz57C6DgCHwhBFtLS952GkmEP
+CAKM9I7wWR3w0Mj5maz4kq2hSzou1j81+ivxSkXMEGsCfwbrjY1QIitZdeEu31ti
+uf9+Jx2tK2yIu7+MLnMnpB7vdXrrPT6wipGMBe8a1/sczE2/foW0e2VarQIuS8bt
+fVpnfXT91Mf0DVn6Bc+ZI3EMG555Ah7GqbVztAlRm6IpbpFyFixx8m6oBwYc/ik6
+fReFzBOq+hV9VPAwYkzGlR+6hhfxhCUyE89LmB2z+fJvEMRj+X8LG21bHTkJoymp
+E/a4NIvOZv1vE3PpK7quZDm9HT/hdTsXbqlfbIBPcpJyUSbTcdBX2jcXfTz0od8Z
+e1iNlQ93d8FHuZFbtYiiZRSWGHPXI3sc96qY12cbUftZy20eN2esn37l13mDi0uS
+Qn0lAQFQwnEF4RROSSoLJefXc9kNXxq2cgZ/rWuUerwQQfMWU5tPwDS5UEoJjQg3
+eK2GH8YMoUuS178X9IU8cXD6vFkSOQ4uZ7L8sY7YHxqo8FeKW+YA7j5U8aNkVC3X
+crlV7VAbfd5k8NDaNe39dM8YNfJre6yBF8Wbvh6HV2a2JgzeQHQPXqLIKC27MCCY
+67P/IHmTis5Yz/tDKwO19N463VrDC6wno6fQdeNe5j3j29/y3YAkJweUtvXCYYJ6
+MOBh5hM+jMJWNSnfERUhjzp+FDoVzZgcxZ8OKbkOr6QZo3WBC7ogoJAVIaNS9Kl+
+RXUhdEd2uoYzwcNEmE9EqRTs8+Yy4VlgPS2iHWy+lboa+1Fi4yAZzeTmAd/BLQNB
+kLUI4OzniBtHn0C4oHz+Lfkm24t5iR5pxIWhNnOOxS0gkObtyWPlcC3LXYZ85ude
+mR8265l5FP9jabzfnCfoZWtdnIBUNcwAcB5oCdChipfJobXrmjyp5W8Sw8enr0BU
+ZJ2MwTGufoeQ3t2IsybY82TuXB6aLegevH3xC4kJV3We83LcUxNhkqmycU935ew0
+cJVQO8C3J5U4Pha8tn1+mKvDaKcv4HmG0YZyN48tdOtR1y4+Xzhq9hSwKl+rzG1Y
+TP0mW1fNfHRDrbykxkIpAXay9kDtfafalMI3ShndZfYiYJBe8IB+m9NML/lEPQyC
+fHH3xPNixHu74a71b6xgMZFhrrXBikfMUB1qroWa+9ocy/5LvdfCRIQN+ti7Tb4F
+FH5qzP/qAfjEdejuIdHHKNs/wkhTixqi8QCkDWEXkDj8AsiVmiBva6luSuQ31OiT
+ERZmRhkZfpkKmo4Jgc12dNsOqXYPF2KJ16bSElfuY5PGYR8JEw9Tz1k1UaMmrOGR
+guU=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/user@ciena.com.pem b/src/test/setup/radius-config/freeradius/certs_2/user@ciena.com.pem
new file mode 100644
index 0000000..6dc7d9b
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/user@ciena.com.pem
@@ -0,0 +1,60 @@
+Bag Attributes
+ localKeyID: 8F EF 1A 9E BD 4E 8D A1 8E 01 DF AF D0 5A 74 29 F5 76 99 DB
+subject=/C=US/ST=CA/O=Ciena Inc./CN=user@ciena.com/emailAddress=user@ciena.com
+issuer=/C=US/ST=CA/L=Somewhere/O=Ciena Inc./emailAddress=admin@ciena.com/CN=Example Certificate Authority
+-----BEGIN CERTIFICATE-----
+MIIDvTCCAqWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBizELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgTAkNBMRIwEAYDVQQHEwlTb21ld2hlcmUxEzARBgNVBAoTCkNpZW5h
+IEluYy4xHjAcBgkqhkiG9w0BCQEWD2FkbWluQGNpZW5hLmNvbTEmMCQGA1UEAxMd
+RXhhbXBsZSBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTYwMzExMTg1MzM2WhcN
+MTcwMzA2MTg1MzM2WjBnMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNV
+BAoTCkNpZW5hIEluYy4xFzAVBgNVBAMUDnVzZXJAY2llbmEuY29tMR0wGwYJKoZI
+hvcNAQkBFg51c2VyQGNpZW5hLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
+AQoCggEBAOxemcBsPn9tZsCa5o2JA6sQDC7A6JgCNXXl2VFzKLNNvB9PS6D7ZBsQ
+5An0zEDMNzi51q7lnrYg1XyiE4S8FzMGAFr94RlGMQJUbRD9V/oqszMX4k++iAOK
+tIA1gr3x7Zi+0tkjVSVzXTmgNnhChAamdMsjYUG5+CY9WAicXyy+VEV3zTphZZDR
+OjcjEp4m/TSXVPYPgYDXI40YZKX5BdvqykWtT/tIgZb48RS1NPyN/XkCYzl3bv21
+qx7Mc0fcEbsJBIIRYTUkfxnsilcnmLxSYO+p+DZ9uBLBzcQt+4Rd5pLSfi21WM39
+2Z2oOi3vs/OYAPAqgmi2JWOv3mePa/8CAwEAAaNPME0wEwYDVR0lBAwwCgYIKwYB
+BQUHAwIwNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5leGFtcGxlLmNvbS9l
+eGFtcGxlX2NhLmNybDANBgkqhkiG9w0BAQUFAAOCAQEALBzMPDTIB6sLyPl0T6JV
+MjOkyldAVhXWiQsTjaGQGJUUe1cmUJyZbUZEc13MygXMPOM4x7z6VpXGuq1c/Vxn
+VzQ2fNnbJcIAHi/7G8W5/SQfPesIVDsHTEc4ZspPi5jlS/MVX3HOC+BDbOjdbwqP
+RX0JEr+uOyhjO+lRxG8ilMRACoBUbw1eDuVDoEBgErSUC44pq5ioDw2xelc+Y6hQ
+dmtYwfY0DbvwxHtA495frLyPcastDiT/zre7NL51MyUDPjjYjghNQEwvu66IKbQ3
+T1tJBrgI7/WI+dqhKBFolKGKTDWIHsZXQvZ1snGu/FRYzg1l+R/jT8cRB9BDwhUt
+yg==
+-----END CERTIFICATE-----
+Bag Attributes
+ localKeyID: 8F EF 1A 9E BD 4E 8D A1 8E 01 DF AF D0 5A 74 29 F5 76 99 DB
+Key Attributes: <No Attributes>
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQI6qtqDG5BZo0CAggA
+MBQGCCqGSIb3DQMHBAi1fAR8FIi0cgSCBMjz9+X+jT+0Bop2xt6SN0SHb/zqlDKP
+Ca1mvOp0+hbID9/lZ4uh71QhxwFnEp/Vnoz2Shxavb75SQKNBVWuazsiJogrFfTj
+d/3PLlTpyIheFLpBkh95Gt4103ON4wPDh2g6j8hpEJoBy4qxb4C8FrWJ05LYjONI
+Uz+zlAn6v2pWkep/kLijb9hCyBjlVRECdArwL/Y7KzFwiGGJX+FtDABrZKfHZw7l
+ovgPQE/7bSG8/8clJ+1IM1AWTFqxpvnj66lWh/DMfoAvNKH45lpGvkbNy9UHIJsu
+1fYyeGibGSisGuLCvsojt/Idmz2O/zU1suv8/ZVV3vRWe+FpUUZqC1rVTKA+BVyy
+vWiFi3u0tezWNiey0y7ocFxIv5+PDH87cG54xRfwQIgDB4QAdcaJpmA4pkU7puhS
+gv54wcAxLRhQGy4lVOiqBkIVzux0m12L/Jh6Ctl8EfYMrrdQeBZMAVtC/qLgv2O4
+cJWVzD69lveMNOekLswaOzKVxwpe2jFeWf9TsDpV1+r+sYcT3b9xHmo7gHLH/Vu5
+RcIRD6QFBKyt8lvqNUSysDA8GnRcw/AInrfaLz7Nly768gkSjMLd1EByCraX8GaD
+8RPl8thtjqbfoC/j2+UjYQw79QnxOia2K0Ft3aXh40YTMQqXDZuoPR3ajaS4Fyz5
+nxnctUtk0i85p8Ge4V3pMZCC6EZdTrzgKv8GvFJLzmy7vfTbJBapK8LlwUJMWyyv
+aED55kkv2lhjPT/Qy4iz5j9/Q5DgEENEB42x0SDK8fjTGZ8vrIEp7kzPMYuqpFZ8
+XFiwHB4brrpq7gxyedG7FbzWqO+t3xSvgXRYDj7WKMUPZXw7QGvGNci2U7GiPVM1
+vPCpIllgh2ZJ9p1vvf44o6Aoh2i4Hkl24zRTSV5L4c5yu8Eeckj6lJubTSlrfa2d
+aEIyO6SK3jgXJKXl70Xv4jAe5M5JDkK85k9HAXQryceWi8dpuHfNb9akFX8vMymh
+QCd2QzROyAytHGAPgH/55hHIg93ORkpMA9GzsutH9+u14uziSpbr3B3j8uOgKTnN
+U+rrEKP9Wm23efJ/X5IzEfFPeGqG4dZDOn9US/WkwiTNFmy834T89DRT609ckSVD
+AhAlQVOXLE2gp/0i+b2vdT1Br+PRqQOXh0sv9x6uL56tvuUG3nnOWGZSljZmEm5p
+Qa8JSjY3ZDn6KC1FJyk4DTf7U38zTi2Z/+AL8K680zEJ6Uc9HI3wVdd19Cf84RdQ
+T6fD/LkvBAWTHzVxMrxYVPqE/3Sf1AJX0cmzciZhxrCml4RQZ78i98/yJaxo7ql7
+0Q34+KaAXHP1QghjmXBERBcyHgNeV/jUUXsxZA/MCkn7PvtCuHkNqc2ZlmN0hLwz
+ObHOo826krBRSlpn7P3DreEjSxzCxPpUXAn6f6bXhtVVIiy6ITkWWfVoLD1/crTc
+sRZMi/EKkmgfIzgCYt3JzAdoii3D7ebxcvfVThbDguOE78OhKY3n4wyJ+FpUn56j
+VcX6Ckl2hAE9qwRNOi383+35A0iUb+vF7ky3K/xMONog+dwdTRkhDbz6rTlO72Tj
+B9xcVJAbopB90NNfrG7LRD472O+t+53C27tG1kyIOaCvXPmeFwgTcLLVjDAyFzXb
+uGo=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/src/test/setup/radius-config/freeradius/certs_2/xpextensions b/src/test/setup/radius-config/freeradius/certs_2/xpextensions
new file mode 100644
index 0000000..8e4a9a2
--- /dev/null
+++ b/src/test/setup/radius-config/freeradius/certs_2/xpextensions
@@ -0,0 +1,24 @@
+#
+# File containing the OIDs required for Windows.
+#
+# http://support.microsoft.com/kb/814394/en-us
+#
+[ xpclient_ext]
+extendedKeyUsage = 1.3.6.1.5.5.7.3.2
+crlDistributionPoints = URI:http://www.example.com/example_ca.crl
+
+[ xpserver_ext]
+extendedKeyUsage = 1.3.6.1.5.5.7.3.1
+crlDistributionPoints = URI:http://www.example.com/example_ca.crl
+
+#
+# Add this to the PKCS#7 keybag attributes holding the client's private key
+# for machine authentication.
+#
+# the presence of this OID tells Windows XP that the cert is intended
+# for use by the computer itself, and not by an end-user.
+#
+# The other solution is to use Microsoft's web certificate server
+# to generate these certs.
+#
+# 1.3.6.1.4.1.311.17.2