On Tue, Jul 29, 2014 at 11:01 AM, Brian West <brian@freeswitch.org> wrote:
It sounds like you used the CA cert as your certificate instead of creating one.I would highly recommend you read this:gen_tls should work also, but I had to do these steps last week as everyone kept reporting that they couldn't use their self signed certs, So I did a little how to on setting up a CA from scratch that would work.On Tue, Jul 29, 2014 at 8:36 AM, sangdrax8 <sangdrax8@gmail.com> wrote:
I am not sure I follow, if you could elaborate any more? I was following https://wiki.freeswitch.org/wiki/SIP_TLS#Configuration and using the provided gentls_cert script. I believe this creates a CA (if one wasn't already created) and then generate and signs certificates. Finally it outputs eveything needed into the agent.pem and cafile.pem files. Since these work, I assume these are the correct type of cert? (Not positive where WSS comes into play).My only issue is when I use my existing certificates that I am using on my current freeswitch, I do not get a certificate passed to the client. Looking at sofia status shows the profile started with (TLS) after it. If I just swap out my certs for the ones the script generated, and restart, everything works again. So I assume there is some requirement that has changed for certs, but I can't figure out what it is wanting.Using the script for my test/dev works just fine, but when I go to replace my running machines I would like to use the existing certs. If I need to recreate them to add something to the cert, I can do that as well, but I will need to do it with the CA I have been using so I need to figure out what options I am missing (assuming that is my problem).On Mon, Jul 28, 2014 at 5:23 PM, Brian West <brian@freeswitch.org> wrote:
The one generated for DTLS isn't the same one you would setup for your WSS connectivity.On Mon, Jul 28, 2014 at 2:10 PM, sangdrax8 <sangdrax8@gmail.com> wrote:
_________________________________________________________________________I can get my latest freeswitch to run TLS profiles if I use the provided scripts to genenrate the CA and the server certs, but not with my own certs. The TLS profile does start with my cert, but when I connect, it does not provide a cert to the client.The only differences I can see in the server cert are the following fields:X509v3 Authority Key Identifier:DirName:/CN=FreeSWITCH CA/O=FreeSWITCHserial:91:F9:22:5D:22:38:6B:09X509v3 Subject Alternative Name:Netscape Cert Type:SSL ServerX509v3 Extended Key Usage:TLS Web Server AuthenticationAs I understand it, the Netscape and Usage designations are not used by freeswitch at this time. So I wouldn't expect them to cause an issue, unless this has changed since the documentation was written.I have the x509v3 Authority Key Identifier, with a keyid field, but I don't have these other two fields which the script puts. Are these required?I also do not have a Alt name defined in my cert, but I wouldn't have thought this would be a required field either.I can't find anything else that appears different to me. If someone can clarify what is required for Freeswitch to use a cert, it would be greatly appreciated!
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
--Brian West
brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest
http://www.freeswitchbook.com
http://www.freeswitchcookbook.comT:+19184209001 | F:+19184209002 | M:+1918424WEST (9378)
iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
--Brian West
brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest
http://www.freeswitchbook.com
http://www.freeswitchcookbook.comT:+19184209001 | F:+19184209002 | M:+1918424WEST (9378)
iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
