Hi all,

Some more things I tried so far:

openssl x509 -noout -modulus -in agent.pem | openssl md5

(stdin)= ebdfb317206ba89d07217c06e1f0d6eb

openssl rsa -noout -modulus -in agent.pem | openssl md5

(stdin)= ebdfb317206ba89d07217c06e1f0d6eb

At least the certificate and private key in the agent.pem are correct.

There is no output on the cli when I try to register a phone.

My guess is that the content of agent.pem and/or cafile.pem is wrong.

Can someone please confirm this?

Best regards,

Adam

Wed, 14 Aug, 2013 at 16:07 PM, Adam <ala@qsc.de>:

Hi all,

i am trying to configure FreeSWITCH to speak TLS with all Clients.

I followed the tutorial on http://wiki.freeswitch.com/wiki/SIP_TLS but I am still not sure what key / cert belongs in which file.

I have a SSL123 Thawte Wildcard Certificate.

Am I supposed to cat this cert + priv. key into agent.pem and the primary and secondary intermediate into the cafile.pem?

I did this and set the right permissions. The internal sofia profile on port 5061 (TLS) is RUNNING.

But no client (for example Polycom VVX1500) can register now.

If I set it TCP and Port 5060 (which is RUNNING as well) everything works fine.

Wireshark shows me the following

Client    ->         FS                    Client Hello

FS        ->         Client                Alert (Level Fatal, Description: Handshake Failure)

I also tested openssl s_client –connect (IP):5061 –showcerts but it only says:

CONNECTED(00000003)

139847050823328:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:724:

---

no peer certificate available

---

No client certificate CA names sent

---

SSL handshake has read 7 bytes and written 225 bytes

---

New, (NONE), Cipher is (NONE)

Secure Renegotiation IS NOT supported

Compression: NONE

Expansion: NONE

---

I guess the problem is the agent.pem and/or cafile.pem

agent.pem looks like this

-----BEGIN CERTIFICATE-----

(Thawte SSL123 Wildcard Web Certificate)

-----END CERTIFICATE-----

-----BEGIN RSA PRIVATE KEY-----

(Unencrypted Private Key)

-----END RSA PRIVATE KEY-----

cafile.pem like that:

-----BEGIN CERTIFICATE-----

(Thawte Primary Intermediate)

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

(Thawte Secondary Intermediate

-----END CERTIFICATE-----

Any suggestions?

Thanks in advance,

Adam