vars.xml doesn't tell FS to do anything - all the variables you define there are simply for convenience to be used elsewhere in the configuration. If you're setting the variable but not actually using it in the SIP profile then it's having no effect. On 26 August 2014 18:27, Tim Smith <randomdev4@gmail.com> wrote:
Hi Brian,
Yup, that doc came up on my Google searches.
And yes, I've done all that as per my original post.
Or are you telling me that despite vars.xml telling it otherwise Freeswitch ignores whatever I put in $base/conf/ssl/ and that I should put the stuff in $base/certs instead because that's where Freeswitch is hardcoded to look?
Tim
On 26 August 2014 18:17, Brian West <brian@freeswitch.org> wrote:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to...
Its very similar to commercial SSL Certs.
On Tue, Aug 26, 2014 at 12:07 PM, Tim Smith <randomdev4@gmail.com> wrote:
Hi Steven,
As you can see, per default config, the only place "tls-cert-der" is mentioned is commented out. I don't have it in any individual profiles either....
/usr/local/freeswitch/conf$ find . -name '*.xml' -print0 | xargs -0 grep 'tls-cert-dir' ./sip_profiles/internal.xml: <!--<param name="tls-cert-dir" value=""/>--> ./sip_profiles/external.xml: <!--<param name="tls-cert-dir" value=""/>-->
Tim
On 26 August 2014 17:50, Steven Ayre <steveayre@gmail.com> wrote:
Check the tls-cert-dir parameter of the SIP profile. Those are only setting variables, they may or may not be used by the actual profile.
On 26 August 2014 14:12, Tim Smith <gb10hkzo-fs1@yahoo.co.uk> wrote:
Hi,
The story so far :
• I've installed new certs • checked config in vars.xml is pointing to the right place • restarted freeswitch entirely • it is still using some sort of internal certificates ?? cafile and agent contain my certs and not those referred to in the openssl output ??
What am I missing ??
Thanks
Tim
FreeSWITCH Version 1.4.8+git~20140821T185758Z~1fe89f530f~64bit (git 1fe89f5 2014-08-21 18:57:58Z 64bit)
/usr/local/freeswitch/conf/ssl# openssl verify -CAfile cafile.pem agent.pem agent.pem: OK
/usr/local/freeswitch/conf# cat vars.xml | grep ssl valid options: sslv2,sslv3,sslv23,tlsv1,tlsv1.1,tlsv1.2 <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> <X-PRE-PROCESS cmd="set" data="internal_ssl_dir=$${base_dir}/conf/ssl"/> <X-PRE-PROCESS cmd="set" data="external_ssl_enable=true"/> <X-PRE-PROCESS cmd="set" data="external_ssl_dir=$${base_dir}/conf/ssl"/>
$ openssl s_client -showcerts -connect my.server:5061 CONNECTED(00000003) depth=0 /C=US/CN=FreeSWITCH verify error:num=18:self signed certificate verify return:1 depth=0 /C=US/CN=FreeSWITCH verify return:1 --- Certificate chain 0 s:/C=US/CN=FreeSWITCH i:/C=US/CN=FreeSWITCH -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- --- Server certificate subject=/C=US/CN=FreeSWITCH issuer=/C=US/CN=FreeSWITCH --- No client certificate CA names sent --- SSL handshake has read 615 bytes and written 328 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None Start Time: Timeout : 300 (sec) Verify return code: 18 (self signed certificate) ---
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org