501828 – net-wireless/wpa_supplicant-2.1 fails to connect with the same config as 2.0-r2

I recently tried upgrading wpa_supplicant to the latest unstable version, 2.1, and it fails to connect using an existing configuration that worked with 2.0. Downgrading to 2.0-r2, without changing anything else, allows me to connect again. Other WPA2 networks work fine, but they don't use MSCHAPv2. I don't have another network using MSCHAPv2 to test against.

I'm unsure if this is a bug in wpa_supplicant itself or not, but I thought I'd start here. I tried changing my USE flags to -gnutls +ssl and still had the issue.

Redacted conf:

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=wheel
update_config=1
ap_scan=1

network={
   sid="*****"

   pairwise=CCMP
   group=CCMP

   proto=WPA2
   key_mgmt=WPA-EAP
   eap=PEAP
   phase2="auth=MSCHAPv2"

   identity="*****"
   password="*****"

   priority=2
}

Redacted output from wpa_cli when it attempts to connect:

<3>SME: Trying to authenticate with 55:55:55:55:55:55 (SSID='*****' freq=5825 MHz)
<3>Trying to associate with 55:55:55:55:55:55 (SSID='*****' freq=5825 MHz)
<3>Associated with 55:55:55:55:55:55
<3>CTRL-EVENT-EAP-STARTED EAP authentication started
<3>CTRL-EVENT-EAP-STATUS status='started' parameter=''
<3>CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
<3>CTRL-EVENT-EAP-STATUS status='accept proposed method' parameter='PEAP'
<3>CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
<3>CTRL-EVENT-EAP-PEER-CERT depth=2 subject='/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA'
<3>CTRL-EVENT-EAP-STATUS status='remote certificate verification' parameter='success'
<3>CTRL-EVENT-EAP-PEER-CERT depth=2 subject='/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA'
<3>CTRL-EVENT-EAP-STATUS status='remote certificate verification' parameter='success'
<3>CTRL-EVENT-EAP-PEER-CERT depth=1 subject='/C=US/O=GeoTrust Inc./OU=Domain Validated SSL/CN=GeoTrust DV SSL CA'
<3>CTRL-EVENT-EAP-STATUS status='remote certificate verification' parameter='success'
<3>CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/serialNumber=******* www.geotrust.com/resources/cps (c)11/OU=Domain Control Validated - QuickSSL(R) Premium/CN=securelogin.aru
<3>CTRL-EVENT-EAP-TLS-CERT-ERROR reason=10 depth=0 subject='/serialNumber=******* /C=US/O=securelogin.arubanetworks.com/*******/OU=See www.geotrust.com/resources/cps (c)11/OU=Domain Control Validated - QuickSSL(R) Premium/CN=
<3>CTRL-EVENT-EAP-STATUS status='remote certificate verification' parameter='Server used client certificate'
<3>CTRL-EVENT-EAP-STATUS status='local TLS alert' parameter='unknown CA'
<3>CTRL-EVENT-EAP-STATUS status='completion' parameter='failure'
<3>CTRL-EVENT-EAP-FAILURE EAP authentication failed
<3>CTRL-EVENT-EAP-STATUS status='completion' parameter='failure'

It seems like the pertinent line is:

<3>CTRL-EVENT-EAP-STATUS status='remote certificate verification' parameter='Server used client certificate'

Reproducible: Always

Steps to Reproduce:
1. Install wpa-supplicant-2.1
2. Attempt to connect to network with similar conf to the above

Actual Results:  
Fails to connect due to a cert error(?).

Expected Results:  
Connected

emerge --info wpa_supplicant
Portage 2.2.7 (default/linux/amd64/13.0, gcc-4.7.3, glibc-2.17, 3.10.25-gentoo x86_64)
=================================================================
                         System Settings
=================================================================
System uname: Linux-3.10.25-gentoo-x86_64-Intel-R-_Core-TM-_i7-3667U_CPU_@_2.00GHz-with-gentoo-2.2
KiB Mem:     8012812 total,   6571652 free
KiB Swap:    7131132 total,   7131132 free
Timestamp of tree: Wed, 19 Feb 2014 01:30:01 +0000
ld GNU ld (GNU Binutils) 2.23.2
app-shells/bash:          4.2_p45
dev-lang/python:          2.7.5-r3, 3.2.5-r3, 3.3.3
dev-util/cmake:           2.8.11.2
dev-util/pkgconfig:       0.28
sys-apps/baselayout:      2.2
sys-apps/openrc:          0.12.4
sys-apps/sandbox:         2.6-r1
sys-devel/autoconf:       2.13, 2.69
sys-devel/automake:       1.10.3, 1.11.6, 1.12.6, 1.13.4
sys-devel/binutils:       2.23.2
sys-devel/gcc:            4.7.3-r1
sys-devel/gcc-config:     1.7.3
sys-devel/libtool:        2.4.2
sys-devel/make:           3.82-r4
sys-kernel/linux-headers: 3.9 (virtual/os-headers)
sys-libs/glibc:           2.17
Repositories: gentoo
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="* -@EULA"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=native -ggdb"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.5/ext-active/ /etc/php/cgi-php5.5/ext-active/ /etc/php/cli-php5.5/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-O2 -pipe -march=native -ggdb"
DISTDIR="/usr/portage/distfiles"
FCFLAGS="-O2 -pipe -march=native -ggdb"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync"
FFLAGS="-O2 -pipe -march=native -ggdb"
GENTOO_MIRRORS="http://gentoo.llarian.net/ ftp://gentoo.llarian.net/pub/gentoo http://mirror.iawnet.sandia.gov/gentoo/"
LANG="en_US.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY=""
USE="10bit X aac aalib acl alsa amd64 apng bash-completion berkdb bindist bzip2 cjk cli cracklib crypt curl cxx dbus device-mapper dri exif flac fortran gdbm gif gnutls gtk gzip iconv ipv6 jpeg jpeg2k lame libass lzma mmx modules mp3 multilib ncurses nls nptl offensive ogg opengl openmp openssl pam pcre png readline rtmp sdl session sna speex sqlite sse sse2 sse4 sse4_1 sse4_2 ssl ssse3 svg tcpd theora threads tiff truetype unicode uxa v4l vim-syntax vmx vorbis x264 xcb xinerama xorg xvid zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" DRACUT_MODULES="lvm crypt debug dm" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" GRUB_PLATFORMS="pc" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en_US en" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-4" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3" RUBY_TARGETS="ruby18 ruby19" USERLAND="GNU" VIDEO_CARDS="intel i915" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, SYNC, USE_PYTHON

=================================================================
                        Package Settings
=================================================================

net-wireless/wpa_supplicant-2.1 was built with the following:
USE="dbus gnutls (multilib) readline ssl -ap -eap-sim -fasteap -p2p (-ps3) -qt4 (-selinux) -smartcard -wimax -wps" ABI_X86="64"