I ran global_getvar certs_dir and got "/etc/freeswitch/tls".
My tls directory contains the following (created by gentls_cert):

CA/

agent.pem

cafile.pem


Setting internal_ssl_enable=true still fails FS with Error Creating SIP UA for profile: internal-ipv6 (sip:mod_sofia@[::1]:5060;transport=udp,tcp) ATTEMPT 1 (RETRY IN 5 SEC)

Setting it to false and everything works again.

On Tue, Sep 15, 2015 at 3:28 PM, Ítalo Rossi <italo@freeswitch.org> wrote:
If you enable internal_ssl_enable then your sip profile will set tls=true (vanilla config) and FreeSWITCH will look for certificates in $${certs_dir}, which is created dynamically. (/usr/local/freeswitch/certs if you compiled or /etc/freeswitch/certs if you installed from packages)

global_getvar certs_dir will output the current value for this var, put your certs there in the right format and see if your profile starts.

On Tue, Sep 15, 2015 at 8:42 AM, Michael Nielsen <mic.niel84@gmail.com> wrote:
Nothing is running on port 5060 and blocking this. When setting the 
internal_ssl_enable=true
it doesnt work, when setting this to false everything works.
Netstat doesn't show anything on port 5060... or 5061.

On Tue, Sep 15, 2015 at 9:36 AM, Michael Nielsen <mic.niel84@gmail.com> wrote:
wss-binding is not set - looking in internal.xml and running grep after wss-binding does not find anything.
Looking at $${internal_ssl_dir} I'm not able to find where this is.
grep'ing after internal_ssl_dir doesn't find anything.

I'm running freeswitch as freeswitch user - so I guess the same user should be on the certificates.

On Mon, Sep 14, 2015 at 10:55 PM, Thomas <lists@virtues.net> wrote:
The "none" option for the policy is part of the old standard config, no idea why it doesn't work (anymore?). Seen that error a lot, but it never prevented the profile from setting up the socket.

You sure none of these ports are already in use? (netstat -lpn) Does the box have an IPv6 interface? Is 159.122.89.10 configured on any interface?

If you did not get this error and the SIP profiles were loading properly before your TLS changes, revert and do it step by step. You can issue a "reload mod_sofia" to test the new config without restarting FS.



On 14.09.2015 17:21, Michael Nielsen wrote:
none, but I've also tried with in. 

On Monday, September 14, 2015, Ítalo Rossi <italo@freeswitch.org> wrote:

On Mon, Sep 14, 2015 at 10:23 AM, Michael Nielsen <mic.niel84@gmail.com> wrote:
When doing so I get the following error in fs_cli:

2015-09-14 08:23:24.120749 [ERR] sofia_glue.c:329 Invalid tls-verify-policy value: none

2015-09-14 08:23:24.160528 [ERR] sofia.c:2935 Error Creating SIP UA for profile: internal-ipv6 (sip:mod_sofia@[::1]:5060;transport=udp,tcp) ATTEMPT 1 (RETRY IN 5 SEC)

2015-09-14 08:23:24.180781 [ERR] sofia.c:2935 Error Creating SIP UA for profile: internal (sip:mod_sofia@159.122.89.10:5060;transport=udp,tcp) ATTEMPT 1 (RETRY IN 5 SEC)


And then sofia status only shows port 5080 running...

On Mon, Sep 14, 2015 at 9:01 AM, Michael Nielsen <mic.niel84@gmail.com> wrote:
I'm running this clean installation of FS:

Everything seems to work and I would now like to add TLS and SRTP encryption - for use on public WiFi and such.


./gentls_cert setup -cn pbx.freeswitch.org -alt DNS:pbx.freeswitch.org -org freeswitch.org
./gentls_cert create_server -cn pbx.freeswitch.org -alt DNS:pbx.freeswitch.org -org freeswitch.org
And in vars.xml:
<X-PRE-PROCESS cmd="set" data="sip_tls_version=sslv23"/>
<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>
Of course with my own domain when generating certificates.

Restarting FS and trying to connect to 5061 over TLS doesn't work.
Looking in fs_cli with debug 7 doesn't output anything when the client tries to connect.

How to debug or does anyone know what's wrong? My certificates are generated automatically in /usr/conf/ssl.


_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org



--
Ítalo Rossi 


_________________________________________________________________________
Professional FreeSWITCH Consulting Services: 
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org


_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org



_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org



--

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org