<div dir="ltr">Check the tls-cert-dir parameter of the SIP profile. Those are only setting variables, they may or may not be used by the actual profile.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On 26 August 2014 14:12, Tim Smith <span dir="ltr"><<a href="mailto:gb10hkzo-fs1@yahoo.co.uk" target="_blank">gb10hkzo-fs1@yahoo.co.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
The story so far :<br>
<br>
• I've installed new certs<br>
• checked config in vars.xml is pointing to the right place<br>
• restarted freeswitch entirely<br>
• it is still using some sort of internal certificates ?? cafile and agent contain my certs and not those referred to in the openssl output ?? <br>
<br>
What am I missing ??<br>
<br>
Thanks <br>
<br>
Tim<br>
<br>
<br>
<br>
FreeSWITCH Version 1.4.8+git~20140821T185758Z~1fe89f530f~64bit (git 1fe89f5 2014-08-21 18:57:58Z 64bit)<br>
<br>
<br>
/usr/local/freeswitch/conf/ssl# openssl verify -CAfile cafile.pem agent.pem<br>
agent.pem: OK<br>
<br>
/usr/local/freeswitch/conf# cat vars.xml | grep ssl<br>
valid options: sslv2,sslv3,sslv23,tlsv1,tlsv1.1,tlsv1.2<br>
<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/><br>
<X-PRE-PROCESS cmd="set" data="internal_ssl_dir=$${base_dir}/conf/ssl"/><br>
<X-PRE-PROCESS cmd="set" data="external_ssl_enable=true"/><br>
<X-PRE-PROCESS cmd="set" data="external_ssl_dir=$${base_dir}/conf/ssl"/><br>
<br>
$ openssl s_client -showcerts -connect my.server:5061<br>
CONNECTED(00000003)<br>
depth=0 /C=US/CN=FreeSWITCH<br>
verify error:num=18:self signed certificate<br>
verify return:1<br>
depth=0 /C=US/CN=FreeSWITCH<br>
verify return:1<br>
---<br>
Certificate chain<br>
0 s:/C=US/CN=FreeSWITCH<br>
i:/C=US/CN=FreeSWITCH<br>
-----BEGIN CERTIFICATE-----<br>
-----END CERTIFICATE-----<br>
---<br>
Server certificate<br>
subject=/C=US/CN=FreeSWITCH<br>
issuer=/C=US/CN=FreeSWITCH<br>
---<br>
No client certificate CA names sent<br>
---<br>
SSL handshake has read 615 bytes and written 328 bytes<br>
---<br>
New, TLSv1/SSLv3, Cipher is AES256-SHA<br>
Server public key is 1024 bit<br>
Secure Renegotiation IS supported<br>
Compression: NONE<br>
Expansion: NONE<br>
SSL-Session:<br>
Protocol : TLSv1<br>
Cipher : AES256-SHA<br>
Session-ID:<br>
Session-ID-ctx: <br>
Master-Key:<br>
Key-Arg : None<br>
Start Time:<br>
Timeout : 300 (sec)<br>
Verify return code: 18 (self signed certificate)<br>
---<br>
<br>
<br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://confluence.freeswitch.org" target="_blank">http://confluence.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
<a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a></blockquote></div><br></div>