Tried to point "secure-chain" parameter to (self-signed) CAcert.pem. The same error code returned 21 (unable to verify ... ).


On Thu, Jul 2, 2015 at 10:47 AM, Nandy Dagondon <nandy1925@gmail.com> wrote:
Hi Luis,

I'm aware of that.  I've digged into SSL/TLS certificates (just self-signed for my intranet setup) and WebRTC - one by one.  Now, all ports are listening for mod_verto 8081, 8082 and 7443. However, FS log shows this error messages like:

2014-08-05 16:44:11.831823 [INFO] mod_verto.c:3209 192.168.10.80:41210 Client Connect.
2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1379 192.168.10.80:41210 Starting client thread.
2014-08-05 16:44:11.831823 [DEBUG] mod_verto.c:1292 192.168.10.80:41210 WS SETUP FAILED
2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1405 192.168.10.80:41210 Ending client thread.
2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1412 192.168.10.80:41210 Thread ended

Upon testing with openssl s_client,  port 443 returned Verify code: 19 (self signed certificate in certificate chain). But in port 7443, it's code: 21 (unable to verify the first certificate).  I encountered this same error code in port 443 before. Solution: added self-signed CA certificate in my web server configuration.

I think I can zero in the solution - how to add the CA certificate to certs/wss.pem?  

Or ... the secure-chain parameter in verto.conf.xml, should point to the CA certificate file? 
      <param name="secure-combined" value="/usr/local/freeswitch/certs/wss.pem"/>
      <param name="secure-chain" value="/usr/local/freeswitch/certs/wss.pem"/>

Any input?

Tks,
/Nandy

On Wed, Jul 1, 2015 at 10:13 PM, Luis Daniel Lucio Quiroz <luis.daniel.lucio@gmail.com> wrote:
More than a script, it would be better if you post minimum cert requirements to let the FS work

Luis Daniel Lucio Quiroz
CISSP, CISM, CISA
Linux, VoIP and much more fun
www.okay.com.mx

Need LCR? Check out LCR for FusionPBX with FreeSWITCH
Need Billing? Check out Billing for FusionPBX with FreeSWITCH

2015-06-30 23:52 GMT-04:00 Nandy Dagondon <nandy1925@gmail.com>:
Hi Brian,

I used your script to generate the certificates to test mod_verto in an intranet setup. Questions on your script:

1) Is 4096 bits required? Or 2048 bits will work, too?
2) Examining certs/wss.pem, there should be a  <chain> certificate at the end. But the script, inputs only 2 - *.crt and *.key. What should be the 3rd?

Tks,
/Nandy


On Sat, Jul 26, 2014 at 2:59 AM, Brian West <brian@freeswitch.org> wrote:
I've corrected the how-to and put it in tree:


Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out.  If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE.


On Fri, Jul 25, 2014 at 1:53 PM, William King <william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work
with the custom CA?

William King
Senior Engineer
Quentus Technologies, INC
1037 NE 65th St Suite 273
Seattle, WA 98115
Main:   (877) 211-9337
Office: (206) 388-4772
Cell:   (253) 686-5518
william.king@quentustech.com

On 07/25/2014 08:12 AM, Brian West wrote:
> Someone should probably turn this into a nice how-to:
>
> Here is how I did it.
>
> wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz
> tar zxfv ssl.ca-0.1.tar.gz
> cd ssl.ca-0.1/
> perl -i -pe 's/md5/sha1/g' *.sh
> perl -i -pe 's/2048/2048/g' *.sh
This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/
> ./new-root-ca.sh
> ./new-server-cert.sh self.bkw.org <http://self.bkw.org>
> ./sign-server-cert.sh self.bkw.org <http://self.bkw.org>
> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem
>
> Setup Apache:
>
> default-ssl:
>
> SSLCertificateFile    /usr/local/freeswitch/certs/wss.pem
> SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem
> SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem
>
> Setup Sofia TLS:
>
> cat self.bkw.org.crt self.bkw.org.key >
> /usr/local/freeswitch/certs/agent.pem
> cat ca.crt > /usr/local/freeswitch/certs/cafile.pem
>
> vars.xml:
>
> <X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/>
> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
>
> Restart FreeSWITCH.
>
> Now make sure your system has ca.crt imported so it will trust your new
> found hotness.
>
> TEST:
>
> openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443>
> openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082>
>
>
> Depending on what you've setup you'll see:
>
> subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web
> Server/CN=self.bkw.org/emailAddress=brian@bkw.org
> <http://self.bkw.org/emailAddress=brian@bkw.org>
>
> issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang
> Bang/OU=Certification Services Division/CN=WBB Root
> CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org>
>
> Or there abouts.
>
> --
>
> */Brian West/*
> brian@freeswitch.org <mailto:brian@freeswitch.org>
>
>
> */Twitter: @FreeSWITCH , @briankwest/*
> http://www.freeswitchbook.com
> http://www.freeswitchcookbook.com
>
> *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378)
> *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
>
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting@freeswitch.org
> http://www.freeswitchsolutions.com
>
> FreeSWITCH-powered IP PBX: The CudaTel Communication Server
> http://www.cudatel.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users@lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>

_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org




--

Brian West
brian@freeswitch.org


Twitter: @FreeSWITCH , @briankwest
http://www.freeswitchbook.com
http://www.freeswitchcookbook.com

T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378)
iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest


_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org



_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org


_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com

Official FreeSWITCH Sites
http://www.freeswitch.org
http://confluence.freeswitch.org
http://www.cluecon.com

FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org