On 26 August 2014 18:27, Tim Smith <randomdev4@gmail.com> wrote:
TimOr are you telling me that despite vars.xml telling it otherwise Freeswitch ignores whatever I put in $base/conf/ssl/ and that I should put the stuff in $base/certs instead because that's where Freeswitch is hardcoded to look?And yes, I've done all that as per my original post.Hi Brian,Yup, that doc came up on my Google searches.
On 26 August 2014 18:17, Brian West <brian@freeswitch.org> wrote:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to_make_your_own_ca_correctly.txt?at=ed7aa96778597f521f0bb2e830277a0d95b21fd7&raw
Its very similar to commercial SSL Certs.--On Tue, Aug 26, 2014 at 12:07 PM, Tim Smith <randomdev4@gmail.com> wrote:
TimHi Steven,As you can see, per default config, the only place "tls-cert-der" is mentioned is commented out. I don't have it in any individual profiles either....
/usr/local/freeswitch/conf$ find . -name '*.xml' -print0 | xargs -0 grep 'tls-cert-dir'
./sip_profiles/internal.xml: <!--<param name="tls-cert-dir" value=""/>-->
./sip_profiles/external.xml: <!--<param name="tls-cert-dir" value=""/>-->
On 26 August 2014 17:50, Steven Ayre <steveayre@gmail.com> wrote:
Check the tls-cert-dir parameter of the SIP profile. Those are only setting variables, they may or may not be used by the actual profile.On 26 August 2014 14:12, Tim Smith <gb10hkzo-fs1@yahoo.co.uk> wrote:
Hi,
The story so far :
• I've installed new certs
• checked config in vars.xml is pointing to the right place
• restarted freeswitch entirely
• it is still using some sort of internal certificates ?? cafile and agent contain my certs and not those referred to in the openssl output ??
What am I missing ??
Thanks
Tim
FreeSWITCH Version 1.4.8+git~20140821T185758Z~1fe89f530f~64bit (git 1fe89f5 2014-08-21 18:57:58Z 64bit)
/usr/local/freeswitch/conf/ssl# openssl verify -CAfile cafile.pem agent.pem
agent.pem: OK
/usr/local/freeswitch/conf# cat vars.xml | grep ssl
valid options: sslv2,sslv3,sslv23,tlsv1,tlsv1.1,tlsv1.2
<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>
<X-PRE-PROCESS cmd="set" data="internal_ssl_dir=$${base_dir}/conf/ssl"/>
<X-PRE-PROCESS cmd="set" data="external_ssl_enable=true"/>
<X-PRE-PROCESS cmd="set" data="external_ssl_dir=$${base_dir}/conf/ssl"/>
$ openssl s_client -showcerts -connect my.server:5061
CONNECTED(00000003)
depth=0 /C=US/CN=FreeSWITCH
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=US/CN=FreeSWITCH
verify return:1
---
Certificate chain
0 s:/C=US/CN=FreeSWITCH
i:/C=US/CN=FreeSWITCH
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
---
Server certificate
subject=/C=US/CN=FreeSWITCH
issuer=/C=US/CN=FreeSWITCH
---
No client certificate CA names sent
---
SSL handshake has read 615 bytes and written 328 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID:
Session-ID-ctx:
Master-Key:
Key-Arg : None
Start Time:
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.orgBrian West
brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest
http://www.freeswitchbook.com
http://www.freeswitchcookbook.comT:+19184209001 | F:+19184209002 | M:+1918424WEST (9378)
iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
