update docs

diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index fd2e4e076f4d371fa1b8e0cae71aa2beb4bead2c..b72d37c21ba28c70a15a3772cf78d8d0ed5fb7dc 100644 (file)
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -1027,11 +1027,6 @@ eap {
        fast {
                # Point to the common TLS configuration
                #
-               # cipher_list though must include "ADH" for anonymous provisioning.
-               # This is not as straight forward as appending "ADH" alongside
-               # "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
-               # recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
-               #
                tls = tls-common
 
                #
@@ -1042,9 +1037,16 @@ eap {
                #  specifications mandata a different set of ciphers
                #  than are used by the other EAP methods.
                #
+               #  cipher_list though must include "ADH" for anonymous provisioning.
+               #  This is not as straight forward as appending "ADH" alongside
+               #  "DEFAULT" as "DEFAULT" contains "!aNULL" so instead it is
+               #  recommended "ALL:!EXPORT:!eNULL:!SSLv2" is used
+               #
+               #  Note - for OpenSSL 1.1.0 and above you may need
+               #  to add ":@SECLEVEL=0"
+               #
                cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2"
 
-
                # PAC lifetime in seconds (default: seven days)
                #
                pac_lifetime = 604800