Using Raspberry Pi as Wifi AP : WPA[2]-PSK works but EAP-TLS results in "IE in 3/4 msg does not match with IE in Beacon/ProbeResp"

For some testing, I’m trying to set up a WPA2-Enterprise network with EAP-TLS, and connect to it from an Android phone. I’m using a Raspberry Pi 4B running Raspbian to host the network, with its in-built wireless adapter. I’m using hostapd to set up the wireless network, and using its integrated EAP server (rather than a separate RADIUS server). Here is my hostapd.conf:

country_code=GB
interface=wlan0
ssid=Pi
hw_mode=g
channel=7
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2 # WPA2 only
ieee8021x=1
wpa_key_mgmt=WPA-EAP
rsn_pairwise=CCMP
wme_enabled=1
ieee80211w=0
ctrl_interface=/var/run/hostapd

eap_server=1 # Use integrated EAP server instead of external
eap_user_file=/etc/hostapd/hostapd.eap_user

ca_cert=/etc/hostapd/keys/ca-cert-selfsigned.pem
server_cert=/etc/hostapd/keys/server-cert-signed-by-ca.pem
private_key=/etc/hostapd/keys/server-unencrypted-private-key.pem


# Logging:
logger_syslog=-1
logger_syslog_level=0
logger_stdout=-1
logger_stdout_level=0

Here is my hostapd.eap_user:

"alice" TLS

My certificates are set up as follows: I generated three keypairs, for the CA, server, and a single client respectively. They are all signed by the CA (so the CA cert is self-signed). The CA cert is installed as a trusted root cert on the Raspberry Pi. On the Android device while setting up the wifi network, I give it the CA certificate and the client’s private key and certificate.

When I try to connect to it from an Android device, it fails. Here are the wpa_supplicant logs I see on Android:

wlan0: Trying to associate with SSID 'Pi'
wlan0: CTRL-EVENT-REGDOM-CHANGE init=USER type=COUNTRY alpha2=00
wlan0: Associated with <REDACTED MAC ADDRESS>
wlan0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
wlan0: CTRL-EVENT-EAP-STARTED EAP authentication started
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=13
TLS - SSL error: error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE
wlan0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 13 (TLS) selected
wlan0: CTRL-EVENT-EAP-PEER-CERT depth=1 subject='/CN=PiNetworkRoot' hash=1406e3c8badbc11b69936fee60ef3ee138cd08ce5c4fcfc0a0a23e4aba89bb50
wlan0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=PiNetworkServer' hash=d62843124235b66100f4c23de52eb4eed76224b094c7917c1be3b5082b6e7a74
wlan0: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
wlan0: PMKSA-CACHE-ADDED <REDACTED MAC ADDRESS> 0
wlan0: WPA: IE in 3/4 msg does not match with IE in Beacon/ProbeResp (src=<REDACTED MAC ADDRESS>)
WPA: RSN IE in Beacon/ProbeResp - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 01 0d 00
WPA: RSN IE in 3/4 msg - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 01 0c 00
wlan0: CTRL-EVENT-DISCONNECTED bssid=<REDACTED MAC ADDRESS> reason=17 locally_generated=1

So it looks like the EAP authentication completed successfully, but then there was some other problem. Here are the hostapd logs for the same:

wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.11: associated
wlan0: STA <MAC ADDRESS REDACTED> WPA: event 1 notification
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: start authentication
wlan0: STA <MAC ADDRESS REDACTED> WPA: start authentication
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: unauthorizing port
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: Sending EAP Packet (identifier 81)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: received EAP packet (code=2 id=81 len=10) from STA: EAP Response-Identity (1)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: Sending EAP Packet (identifier 82)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: received EAP packet (code=2 id=82 len=145) from STA: EAP Response-TLS (13)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: Sending EAP Packet (identifier 83)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: received EAP packet (code=2 id=83 len=6) from STA: EAP Response-TLS (13)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: Sending EAP Packet (identifier 84)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: received EAP packet (code=2 id=84 len=1408) from STA: EAP Response-TLS (13)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: Sending EAP Packet (identifier 85)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: received EAP packet (code=2 id=85 len=473) from STA: EAP Response-TLS (13)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: Sending EAP Packet (identifier 86)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: received EAP packet (code=2 id=86 len=6) from STA: EAP Response-TLS (13)
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.1X: Sending EAP Packet (identifier 86)
wlan0: STA <MAC ADDRESS REDACTED> WPA: sending 1/4 msg of 4-Way Handshake
wlan0: STA <MAC ADDRESS REDACTED> WPA: received EAPOL-Key frame (2/4 Pairwise)
wlan0: STA <MAC ADDRESS REDACTED> WPA: sending 3/4 msg of 4-Way Handshake
wlan0: STA <MAC ADDRESS REDACTED> IEEE 802.11: disassociated
wlan0: STA <MAC ADDRESS REDACTED> WPA: event 2 notification

I tried Googling "IE in 3/4 msg does not match with IE in Beacon/ProbeResp" and found several results, some quite old. Some mentioned wme_enabled=0, so I tried that, but it was still the same issue. This talked about PMF on a related but different problem, from which I got to ieee80211w=1. I tried that too (all 4 combinations of having/not having ieee80211w=1 and wme_enabled=0). But it’s the same error in all cases. Any ideas on how to fix this?

Changing wpa=2 to wpa=1 made the connection succeed, which suffices for my testing purposes, though potentially not for real use depending on requirements.

This bug might be relevant.

---

The wifi network works if I use PSK instead of EAP-TLS, as with the following hostapd.conf:

country_code=GB
interface=wlan0
ssid=Pi_PSK
hw_mode=g
channel=7
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=Foobar
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

I can connect to this network successfully from the same Android device.

rsn_preauth=1
rsn_preauth_interface=eth0