Old thread, but in case it helps anyone. For SessionTalk + FreeSwitch, you need to set openssl.cnf params rock bottom low: [system_default_sect] MinProtocol = TLSv1 CipherString = DEFAULT@SECLEVEL=1 I've followed-up with SessionTalk support to check on TLS V1.2 and stronger cipher suite. However my hopes are low since they haven't though of it on their own. App store feedback pending... On 2019-11-13 3:01 p.m., Sebastian Kemper wrote:
On Tue, Nov 12, 2019 at 10:38:40PM +0100, Walter Behrend wrote:
Btw, I think there is a problem in freeswitch - if for example I configure stunnel, there is no problem with specifying accepting also older TLS standards without the need of changing the MinProtocol setting within the openssl.cnf file. As a user or admin, I would normally expect the tls-version parameter to do the same job for me... Hi Walter,
I guess that's a point of view. I was quite happy to find that OpenSSL enforces the restrictions set in /etc/ssl/openssl.cnf also when used through FreeSWITCH. I'd find it rather strange if it didn't, honestly. If they're the default settings then they have to be enforced whenever OpenSSL is used, in my opinion.
I've tested with an updated message digest in gentls_cert (SHA256 like you suggested) and can confirm it's working properly with this. I've sent a pull request via GitHub to FS.
Regards, Seb
_________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com