[Freeswitch-users] TLS and SRTP commercial certs go in which file?
Bipin Patel
bipin at xbipin.com
Mon Sep 18 10:32:54 UTC 2017
hi,
after playing around i figured this, some corrections i need to make for
others willing to use the same:
agent.pem file needs to have ur commercial cert followed by the private
key but if u just use that zoiper for android will give a warning about
untrusted cert so we need to also add the intermediary followed by the
root CA cert in the the cafile.pem to avoid this warning on client side.
wss.pem is used for verto which needs to have ur commercial cert
followed by its private key followed by intermediary cert followed by
root CA cert, if u dont use verto then ignore this file and FS will self
create it when using only TLS and SRTP.
tls.pem file i think is used as default cert but i just copied the data
from agent.pem to this
dtls-srtp.pem is used for verto so i think that got created by default also
bear in mind zoiper for android doesnt allow to import ur own certs but
just uses its own self signed cert so i add to set tls-verify-policy to
none to make it work
Regards,
Bipin
------------------------------------------------------------------------
-------- Original Message --------
Subject: Re: [Freeswitch-users] TLS and SRTP commercial certs go in
which file?
From: Shaun Stokes <shaun.stokes at itec-support.co.uk>
To: FreeSWITCH Users Help <freeswitch-users at lists.freeswitch.org>
Date: 9/18/2017, 12:03:47 PM
>
> Hi Bipin,
>
> Putting the same into all 4 pem’s certainly works, and that’s correct
> no intermediary or root ca required providing you have the public and
> private key in your pem files.
>
> The wiki article for SIP_TLS could do with being updated, but I don’t
> know exactly what each of the 4 certs are used for.
>
> This is my best guess at what each of the certificates are used for.
>
> agent.pem – FreeSWITCH public server cert
>
> tls.pem – Used for TLS communication
>
> dtls-srtp.pem – Used for DTLS\SRTP communication
>
> wss.pem – Used for WebRTC communication
>
> Shaun
>
> *From:*FreeSWITCH-users
> [mailto:freeswitch-users-bounces at lists.freeswitch.org] *On Behalf Of
> *Bipin Patel
> *Sent:* 17 September 2017 05:43
> *To:* FreeSWITCH Users Help <freeswitch-users at lists.freeswitch.org>
> *Subject:* Re: [Freeswitch-users] TLS and SRTP commercial certs go in
> which file?
>
> Hi,
>
> Thanks for that info so if I understood it right the agent.pem file
> will have my cert and key inside it only and no intermediary or root
> ca cert is required at all, but what goes in the tls.pem file?
>
> On September 17, 2017 5:45:28 AM Shaun Stokes
> <shaun.stokes at itec-support.co.uk
> <mailto:shaun.stokes at itec-support.co.uk>> wrote:
>
> Hi Bipin,
>
> We've found that these are the certs which FreeSWITCH will use,
> the pem file will need the public and private key (same as your
> wss cert). You'll also need to make sure the user for FreeSWITCH
> has read permission to the certs.
>
> agent.pem
>
> dtls-srtp.pem
>
> tls.pem
>
> wss.pem
>
> FreeSWITCH doesn't seem to need the intermediary and root cert of
> the CA.
>
> Here are some of the TLS parameters you might also want on your
> SIP profile.
>
> Name: tls
>
> Value: true
>
> Name: tls-bind-params
>
> Value: transport=tls
>
> Name: tls-cert-dir
>
> Value: "Your Cert Directory Path"
>
> Name: tls-sip-port
>
> Value: 5061
>
> Name: tls-verify-date
>
> Value: true
>
> Name: tls-verify-depth
>
> Value: 2
>
> Name: tls-verify-policy
>
> Value: all|subjects_all
>
> Name: tls-version
>
> Value: tlsv1.2
>
> Shaun
>
> *From:*FreeSWITCH-users
> [mailto:freeswitch-users-bounces at lists.freeswitch.org] *On Behalf
> Of *Bipin Patel
> *Sent:* 16 September 2017 06:49
> *To:* FreeSWITCH Users Help <freeswitch-users at lists.freeswitch.org
> <mailto:freeswitch-users at lists.freeswitch.org>>
> *Subject:* Re: [Freeswitch-users] TLS and SRTP commercial certs go
> in which file?
>
> hi,
>
> no one?
>
> Regards,
> Bipin
>
> ------------------------------------------------------------------------
>
> -------- Original Message --------
> Subject: [Freeswitch-users] TLS and SRTP commercial certs go in
> which file?
> From: Bipin Patel <bipin at xbipin.com> <mailto:bipin at xbipin.com>
> To: FreeSWITCH Users Help <freeswitch-users at lists.freeswitch.org>
> <mailto:freeswitch-users at lists.freeswitch.org>
> Date: 9/15/2017, 3:44:33 PM
>
> hi,
>
> when i setup verto on my server i used commercial certificates
> with wss.pem containing the following and all that works
> brilliant:
> -----BEGIN CERTIFICATE-----
> <lots of gibberish from the actual certificate>
> -----END CERTIFICATE-----
> -----BEGIN RSA PRIVATE KEY-----
> <lots of gibberish from the actual certificate>
> -----END RSA PRIVATE KEY-----
> -----BEGIN CERTIFICATE-----
> <lots of gibberish from the intermediate certificate>
> -----END CERTIFICATE-----
> -----BEGIN CERTIFICATE-----
> <even more gibberish from the root certificate>
> -----END CERTIFICATE-----
>
> now i want to use the same certificate for TLS and SRTP and i
> was reading the docs and it mentioned to create a agent.pem
> file with the actual server cert and key but where do i copy
> the intermediatory and root cert of the CA, which folders do
> both go in and with what filename?
>
> any help is appreciated
>
> --
> Regards,
> Bipin
>
> ------------------------------------------------------------------------
>
> _________________________________________________________________________
>
> Professional FreeSWITCH Consulting Services:
>
> consulting at freeswitch.org <mailto:consulting at freeswitch.org>
>
> http://www.freeswitchsolutions.com
>
>
>
> Official FreeSWITCH Sites
>
> http://www.freeswitch.org
>
> http://confluence.freeswitch.org
>
> http://www.cluecon.com
>
>
>
> FreeSWITCH-users mailing list
>
> FreeSWITCH-users at lists.freeswitch.org
> <mailto:FreeSWITCH-users at lists.freeswitch.org>
>
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>
> http://www.freeswitch.org
>
>
>
> ______________________________________________________________________
> This message has been checked for all known viruses by MessageLabs
> Virus Scanning Service.
> ______________________________________________________________________
>
>
>
> Shaun Stokes - Infrastructure Analyst
>
>
>
>
> T :
>
>
>
> 01453 700713
>
> E :
>
>
>
> shaun.stokes at itec-support.co.uk
> <mailto:shaun.stokes at itec-support.co.uk>
>
> W :
>
>
>
> www.itec-support.co.uk <http://www.itec-support.co.uk>
>
> Registered Address :- ITEC Support, Suite 2 Prospect House, Bath
> Road, Stroud, Gloucestershire GL5 3QF
> Company No. 06908001
>
>
> CONFIDENTIALITY NOTICE
> This communication and the information it contains are intended
> for the person or organisation to which it is addressed. Its
> contents are confidential and may be protected in law.
> Unauthorised use, copying or disclosure of any of it may be
> unlawful. If you are not the intended recipient, please contact us
> immediately.
> The contents of any attachments in this e-mail may contain
> software viruses, which could damage your own computer system.
> While ITEC Support has taken every reasonable precaution to
> minimise this risk, we cannot accept liability for any damage
> which you sustain as a result of software viruses. You should
> carry out your own virus checking procedure before opening any
> attachment.
>
>
> ______________________________________________________________________
> This message has been checked for all known viruses by MessageLabs
> Virus Scanning Service.
> ______________________________________________________________________
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org <mailto:consulting%40freeswitch.org>
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> <mailto:FreeSWITCH-users%40lists.freeswitch.org>
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>
> ______________________________________________________________________
> This message has been checked for all known viruses by MessageLabs
> Virus Scanning Service.
> ______________________________________________________________________
>
>
> ______________________________________________________________________
> This message has been checked for all known viruses by MessageLabs
> Virus Scanning Service.
> ______________________________________________________________________
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20170918/7b17b55e/attachment-0001.html>
More information about the FreeSWITCH-users
mailing list