I’ve been meaning to look into NAPTR, excellent that sounds like just what I need. How does it enable the use of one domain? I’m reading through the NAPTR docs but it’s all geared towards a single domain name. I guess NAPTR records for multiple domains could point to the same _sips._udp.domain.com <http://udp.domain.com/>… but will they still register with their original realm? I guess so as that’s part of the SIP headers rather than the DNS?

On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com> wrote:

Try NAPTR and SRV records. In this case required only one certificate. Requirements sip clients must support NAPRT or SRV records for TLS connection

пт, 17 марта 2017, 22:28 Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>: Trying to get my head around setting TLS up. I have one internal sip profile, but multiple domains & dialplans.

If I want to enable TLS on multiple domains, I think I’m right in saying that I will then need multiple sip profiles, in order to set the TLS up in each?

I guess my confusion comes from understanding the difference between domains, profiles and sip profiles. I’m not even sure exactly what question I’m asking here, so apologies!

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Anyone got any ideas? Must be something I’ve missed, but it’s really odd behaviour…?

On 17 Mar 2017, at 20:25, Rick Jarvis <rick@magicmail.mooo.com> wrote:

also, the thing that’s really bugging me ATM is that if I enable TLS, just by setting the following:

<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>

I get:

2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for profile: internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp <sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp>) The likely causes for this are: 1) Another application is already listening on the specified address. 2) The IP the profile is attempting to bind to is not local to this system.

Yet the TLS port is set to 5061, so how can this be?

...

On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com <mailto:s.safarov@gmail.com>> wrote:

Try NAPTR and SRV records. In this case required only one certificate. Requirements sip clients must support NAPRT or SRV records for TLS connection

пт, 17 марта 2017, 22:28 Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>: Trying to get my head around setting TLS up. I have one internal sip profile, but multiple domains & dialplans.

If I want to enable TLS on multiple domains, I think I’m right in saying that I will then need multiple sip profiles, in order to set the TLS up in each?

I guess my confusion comes from understanding the difference between domains, profiles and sip profiles. I’m not even sure exactly what question I’m asking here, so apologies!

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Yes that’s correct - I even copied the vanilla internal.xml over it just to make sure…

On 20 Mar 2017, at 11:44, David Ponzone <david.ponzone@ipeva.fr> wrote:

Stupid question you will probably think but did you check that in internal.xml, you have:

<param name="sip-ip" value="the correct IP address"/> <param name="tls-sip-port" value="$${internal_tls_port} »/>

And not something fishy ?

David Ponzone Direction Technique email: david.ponzone@ipeva.fr <mailto:david.ponzone@ipeva.fr> tel: 01 74 03 18 97 gsm: 06 66 98 76 34

Service Client IPeva tel: 0811 46 26 26 www.ipeva.fr <blocked::http://www.ipeva.fr/> - www.ipeva-studio.com <blocked::http://www.ipeva-studio.com/>

Ce message et toutes les pièces jointes sont confidentiels et établis à l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisée est interdite. Tout message électronique est susceptible d'altération. IPeva décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur.

...

Le 20 mars 2017 à 12:28, Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>> a écrit :

Anyone got any ideas? Must be something I’ve missed, but it’s really odd behaviour…?

...

On 17 Mar 2017, at 20:25, Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>> wrote:

also, the thing that’s really bugging me ATM is that if I enable TLS, just by setting the following:

<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>

I get:

2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for profile: internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp <sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp>) The likely causes for this are: 1) Another application is already listening on the specified address. 2) The IP the profile is attempting to bind to is not local to this system.

Yet the TLS port is set to 5061, so how can this be?

...

On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com <mailto:s.safarov@gmail.com>> wrote:

Try NAPTR and SRV records. In this case required only one certificate. Requirements sip clients must support NAPRT or SRV records for TLS connection

пт, 17 марта 2017, 22:28 Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>: Trying to get my head around setting TLS up. I have one internal sip profile, but multiple domains & dialplans.

If I want to enable TLS on multiple domains, I think I’m right in saying that I will then need multiple sip profiles, in order to set the TLS up in each?

I guess my confusion comes from understanding the difference between domains, profiles and sip profiles. I’m not even sure exactly what question I’m asking here, so apologies!

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

For what it's worth I've had this error when freeswitch couldn't open the required certificates for SSL. Turning up the freeswitch logging revealed the system call to open the certicate was failing with no such file... On Fri, March 17, 2017 8:25 pm, Rick Jarvis wrote:

also, the thing that’s really bugging me ATM is that if I enable TLS, just by setting the following:

<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>

I get:

2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for profile: internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp) The likely causes for this are: 1) Another application is already listening on the specified address. 2) The IP the profile is attempting to bind to is not local to this system.

Yet the TLS port is set to 5061, so how can this be?

...

On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com> wrote:

Try NAPTR and SRV records. In this case required only one certificate. Requirements sip clients must support NAPRT or SRV records for TLS connection

пт, 17 марта 2017, 22:28 Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>: Trying to get my head around setting TLS up. I have one internal sip profile, but multiple domains & dialplans.

If I want to enable TLS on multiple domains, I think I’m right in saying that I will then need multiple sip profiles, in order to set the TLS up in each?

I guess my confusion comes from understanding the difference between domains, profiles and sip profiles. I’m not even sure exactly what question I’m asking here, so apologies!

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

It probably depends on the client configuration if you get an invalid certificate for self signed or not. Most seem happy by default when I've tried. I've had no problems using letsencrypt certificates for TLS. If it is a certificate issue (you can check by turning up the logging) I'd imagine either the certificate isn't readable by freeswitch (by default I think it'll be chmod 600 and owned by root) or it's wrongly constructed. I have wss.pem as a symlink wss.pem -> /etc/letsencrypt/wss.pem # ls -l /etc/letsencrypt/wss.pem -rw-r----- 1 freeswitch freeswitch 10868 Mar 8 18:46 /etc/letsencrypt/wss.pem and created wss.pem via cat /etc/letsencrypt/live/sip.netscum.org.uk/cert.pem /etc/letsencrypt/live/sip.netscum.org.uk/privkey.pem /etc/letsencrypt/live/sip.netscum.org.uk/chain.pem /etc/letsencrypt/live/sip.netscum.org.uk/fullchain.pem > /etc/letsencrypt/wss.pem On 20/03/17 22:08, Rick Jarvis wrote:

Thanks Stefan, that’s a huge help - hadn’t crossed my mind it could be a cert error, given the description. I’m currently using letsencrypt’s certbot to download the certs and symbolic linking to them. Maybe I should just try the generator that the docs recommend, but am wondering if that will present the non-valid CA issues one gets with web browsers (I’m not all that clear on whether this applies to SIP clients or not?!)...

...

On 20 Mar 2017, at 15:36, Stefan Davids <freeswitch@stefan.davids.uk.net> wrote:

For what it's worth I've had this error when freeswitch couldn't open the required certificates for SSL.

Turning up the freeswitch logging revealed the system call to open the certicate was failing with no such file...

On Fri, March 17, 2017 8:25 pm, Rick Jarvis wrote:

...

also, the thing that’s really bugging me ATM is that if I enable TLS, just by setting the following:

<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>

I get:

2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for profile: internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp) The likely causes for this are: 1) Another application is already listening on the specified address. 2) The IP the profile is attempting to bind to is not local to this system.

Yet the TLS port is set to 5061, so how can this be?

...

On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com> wrote:

Try NAPTR and SRV records. In this case required only one certificate. Requirements sip clients must support NAPRT or SRV records for TLS connection

пт, 17 марта 2017, 22:28 Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>: <freeswitch@stefan.davids.uk.net> Trying to get my head around setting TLS up. I have one internal sip profile, but multiple domains & dialplans.

If I want to enable TLS on multiple domains, I think I’m right in saying that I will then need multiple sip profiles, in order to set the TLS up in each?

I guess my confusion comes from understanding the difference between domains, profiles and sip profiles. I’m not even sure exactly what question I’m asking here, so apologies!

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Do you see registers coming in? If so, check nothing is also listening there, this happened to me once (on a different port) and it was wss, which also shows as freeswitch listening On Mon, Apr 3, 2017 at 7:39 PM Rick Jarvis <rick@magicmail.mooo.com> wrote:

This was really helpful, thank you!

Struggling now with the registration over TLS for some reason. sofia shows TLS on 5061, netstat shows listening on port 5061, firewall is completely open, sip internal tls enabled, but whilst handsets register fine on TCP, they timeout on TLS. Is TLS somehow more problematic with NAT traversal maybe? Nothing showing in freeswitch.log, should I be looking elsewhere or increasing the logging maybe?

Thanks again! R

On 21 Mar 2017, at 09:24, Stefan Davids <freeswitch@stefan.davids.uk.net> wrote:

It probably depends on the client configuration if you get an invalid certificate for self signed or not. Most seem happy by default when I've tried.

I've had no problems using letsencrypt certificates for TLS.

If it is a certificate issue (you can check by turning up the logging) I'd imagine either the certificate isn't readable by freeswitch (by default I think it'll be chmod 600 and owned by root) or it's wrongly constructed.

I have wss.pem as a symlink

wss.pem -> /etc/letsencrypt/wss.pem

# ls -l /etc/letsencrypt/wss.pem -rw-r----- 1 freeswitch freeswitch 10868 Mar 8 18:46 /etc/letsencrypt/wss.pem

and created wss.pem via

cat /etc/letsencrypt/live/sip.netscum.org.uk/cert.pem /etc/letsencrypt/live/sip.netscum.org.uk/privkey.pem /etc/letsencrypt/live/sip.netscum.org.uk/chain.pem/etc/letsencrypt/live/ sip.netscum.org.uk/fullchain.pem > /etc/letsencrypt/wss.pem

On 20/03/17 22:08, Rick Jarvis wrote:

Thanks Stefan, that’s a huge help - hadn’t crossed my mind it could be a cert error, given the description. I’m currently using letsencrypt’s certbot to download the certs and symbolic linking to them. Maybe I should just try the generator that the docs recommend, but am wondering if that will present the non-valid CA issues one gets with web browsers (I’m not all that clear on whether this applies to SIP clients or not?!)...

On 20 Mar 2017, at 15:36, Stefan Davids <freeswitch@stefan.davids.uk.net> wrote:

For what it's worth I've had this error when freeswitch couldn't open the required certificates for SSL.

Turning up the freeswitch logging revealed the system call to open the certicate was failing with no such file...

On Fri, March 17, 2017 8:25 pm, Rick Jarvis wrote:

also, the thing that’s really bugging me ATM is that if I enable TLS, just by setting the following:

<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>

I get:

2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for profile: internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp) The likely causes for this are: 1) Another application is already listening on the specified address. 2) The IP the profile is attempting to bind to is not local to this system.

Yet the TLS port is set to 5061, so how can this be?

On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com> wrote:

Try NAPTR and SRV records. In this case required only one certificate. Requirements sip clients must support NAPRT or SRV records for TLS connection

пт, 17 марта 2017, 22:28 Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com <rick@magicmail.mooo.com>>>: < freeswitch@stefan.davids.uk.net> Trying to get my head around setting TLS up. I have one internal sip profile, but multiple domains & dialplans.

If I want to enable TLS on multiple domains, I think I’m right in saying that I will then need multiple sip profiles, in order to set the TLS up in each?

I guess my confusion comes from understanding the difference between domains, profiles and sip profiles. I’m not even sure exactly what question I’m asking here, so apologies!

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org < mailto:FreeSWITCH-users@lists.freeswitch.org <FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/

...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

If you don't see anything coming in, it's not freeswitch. I mean if you don't see anything with tshark/ngrep , then It's not freeswitch. Look elsewhere... On Mon, Apr 3, 2017 at 8:53 PM Rick Jarvis <rick@magicmail.mooo.com> wrote: Have to confess I don’t know what wss is? Stefan suggested I cat my certs into wss.pem as per below, which seems to have worked to get the port listening but not sure if that’s what you mean? I can’t see anything coming in at all, it’s as if the firewall isn’t open on 5061 but it’s open to every port so can’t be that... On 3 Apr 2017, at 18:42, David Villasmil <david.villasmil.work@gmail.com> wrote: Do you see registers coming in? If so, check nothing is also listening there, this happened to me once (on a different port) and it was wss, which also shows as freeswitch listening On Mon, Apr 3, 2017 at 7:39 PM Rick Jarvis <rick@magicmail.mooo.com> wrote: This was really helpful, thank you! Struggling now with the registration over TLS for some reason. sofia shows TLS on 5061, netstat shows listening on port 5061, firewall is completely open, sip internal tls enabled, but whilst handsets register fine on TCP, they timeout on TLS. Is TLS somehow more problematic with NAT traversal maybe? Nothing showing in freeswitch.log, should I be looking elsewhere or increasing the logging maybe? Thanks again! R On 21 Mar 2017, at 09:24, Stefan Davids <freeswitch@stefan.davids.uk.net> wrote: It probably depends on the client configuration if you get an invalid certificate for self signed or not. Most seem happy by default when I've tried. I've had no problems using letsencrypt certificates for TLS. If it is a certificate issue (you can check by turning up the logging) I'd imagine either the certificate isn't readable by freeswitch (by default I think it'll be chmod 600 and owned by root) or it's wrongly constructed. I have wss.pem as a symlink wss.pem -> /etc/letsencrypt/wss.pem # ls -l /etc/letsencrypt/wss.pem -rw-r----- 1 freeswitch freeswitch 10868 Mar 8 18:46 /etc/letsencrypt/wss.pem and created wss.pem via cat /etc/letsencrypt/live/sip.netscum.org.uk/cert.pem /etc/letsencrypt/live/ sip.netscum.org.uk/privkey.pem /etc/letsencrypt/live/ sip.netscum.org.uk/chain.pem/etc/letsencrypt/live/ sip.netscum.org.uk/fullchain.pem > /etc/letsencrypt/wss.pem On 20/03/17 22:08, Rick Jarvis wrote: Thanks Stefan, that’s a huge help - hadn’t crossed my mind it could be a cert error, given the description. I’m currently using letsencrypt’s certbot to download the certs and symbolic linking to them. Maybe I should just try the generator that the docs recommend, but am wondering if that will present the non-valid CA issues one gets with web browsers (I’m not all that clear on whether this applies to SIP clients or not?!)... On 20 Mar 2017, at 15:36, Stefan Davids <freeswitch@stefan.davids.uk.net> wrote: For what it's worth I've had this error when freeswitch couldn't open the required certificates for SSL. Turning up the freeswitch logging revealed the system call to open the certicate was failing with no such file... On Fri, March 17, 2017 8:25 pm, Rick Jarvis wrote: also, the thing that’s really bugging me ATM is that if I enable TLS, just by setting the following: <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> I get: 2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for profile: internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp) The likely causes for this are: 1) Another application is already listening on the specified address. 2) The IP the profile is attempting to bind to is not local to this system. Yet the TLS port is set to 5061, so how can this be? On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com> wrote: Try NAPTR and SRV records. In this case required only one certificate. Requirements sip clients must support NAPRT or SRV records for TLS connection пт, 17 марта 2017, 22:28 Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com <rick@magicmail.mooo.com>>>: < freeswitch@stefan.davids.uk.net> Trying to get my head around setting TLS up. I have one internal sip profile, but multiple domains & dialplans. If I want to enable TLS on multiple domains, I think I’m right in saying that I will then need multiple sip profiles, in order to set the TLS up in each? I guess my confusion comes from understanding the difference between domains, profiles and sip profiles. I’m not even sure exactly what question I’m asking here, so apologies! _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/> FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org < mailto:FreeSWITCH-users@lists.freeswitch.org <FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Do you have siptrace turned on for that profile? If that's on and logging nothing check you can see a successful TLS handshake with tshark; eg run sudo tshark -i any -f "port 5061" and then get something to try to register (make sure any previous session has timed out). I get, for example: 1 0.000000 82.132.240.202 -> 81.187.168.242 TCP 76 38035→5061 [SYN] Seq=0 Win=14600 Len=0 MSS=1432 SACK_PERM=1 TSval=405135258 TSecr=0 WS=512 2 0.000241 81.187.168.242 -> 82.132.240.202 TCP 76 5061→38035 [SYN, ACK] Seq=0 Ack=1 Win=28800 Len=0 MSS=1452 SACK_PERM=1 TSval=1319863800 TSecr=405135258 WS=128 3 0.028737 82.132.240.202 -> 81.187.168.242 TCP 68 38035→5061 [ACK] Seq=1 Ack=1 Win=14848 Len=0 TSval=405135287 TSecr=1319863800 4 0.029051 82.132.240.202 -> 81.187.168.242 SSL 259 Client Hello 5 0.029207 81.187.168.242 -> 82.132.240.202 TCP 68 5061→38035 [ACK] Seq=1 Ack=192 Win=29952 Len=0 TSval=1319863803 TSecr=405135287 6 0.263779 81.187.168.242 -> 82.132.240.202 TLSv1 1488 Server Hello 7 0.263871 81.187.168.242 -> 82.132.240.202 TLSv1 1488 Certificate 8 0.263944 81.187.168.242 -> 82.132.240.202 TLSv1 635 Server Key Exchange etc. I've seen old clients which only support SSLv2 or SSLv3 whereas Freeswitch by default won't (for security reasons). Maybe say what client you're trying to use? It might have some known quirks... On Tue, April 4, 2017 11:05 am, Rick Jarvis wrote:

I can see it in ngrep, and the conversations look similar to when the register is occurring in TCP, i.e.

phone:randomport -> server:5061 server:5061 -> phone:randomport

But it fails to register as if it’s timing out, and I can’t find any logging on FS to confirm that the conversation took place.

...

On 3 Apr 2017, at 20:29, David Villasmil <david.villasmil.work@gmail.com> wrote:

If you don't see anything coming in, it's not freeswitch. I mean if you don't see anything with tshark/ngrep , then It's not freeswitch. Look elsewhere...

On Mon, Apr 3, 2017 at 8:53 PM Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>> wrote: Have to confess I don’t know what wss is? Stefan suggested I cat my certs into wss.pem as per below, which seems to have worked to get the port listening but not sure if that’s what you mean?

I can’t see anything coming in at all, it’s as if the firewall isn’t open on 5061 but it’s open to every port so can’t be that...

...

On 3 Apr 2017, at 18:42, David Villasmil <david.villasmil.work@gmail.com <mailto:david.villasmil.work@gmail.com>> wrote:

Do you see registers coming in? If so, check nothing is also listening there, this happened to me once (on a different port) and it was wss, which also shows as freeswitch listening On Mon, Apr 3, 2017 at 7:39 PM Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>> wrote: This was really helpful, thank you!

Struggling now with the registration over TLS for some reason. sofia shows TLS on 5061, netstat shows listening on port 5061, firewall is completely open, sip internal tls enabled, but whilst handsets register fine on TCP, they timeout on TLS. Is TLS somehow more problematic with NAT traversal maybe? Nothing showing in freeswitch.log, should I be looking elsewhere or increasing the logging maybe?

Thanks again! R

...

On 21 Mar 2017, at 09:24, Stefan Davids <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net>> wrote:

...

It probably depends on the client configuration if you get an invalid certificate for self signed or not. Most seem happy by default when I've tried.

I've had no problems using letsencrypt certificates for TLS.

If it is a certificate issue (you can check by turning up the logging) I'd imagine either the certificate isn't readable by freeswitch (by default I think it'll be chmod 600 and owned by root) or it's wrongly constructed.

I have wss.pem as a symlink

wss.pem -> /etc/letsencrypt/wss.pem

# ls -l /etc/letsencrypt/wss.pem -rw-r----- 1 freeswitch freeswitch 10868 Mar 8 18:46 /etc/letsencrypt/wss.pem

and created wss.pem via

...

cat /etc/letsencrypt/live/sip.netscum.org.uk/cert.pem <http://sip.netscum.org.uk/cert.pem> /etc/letsencrypt/live/sip.netscum.org.uk/privkey.pem <http://sip.netscum.org.uk/privkey.pem> /etc/letsencrypt/live/sip.netscum.org.uk/chain.pem <http://sip.netscum.org.uk/chain.pem>/etc/letsencrypt/live/sip.netscum.org.uk/fullchain.pem <http://sip.netscum.org.uk/fullchain.pem> > /etc/letsencrypt/wss.pem

...

On 20/03/17 22:08, Rick Jarvis wrote:

...

Thanks Stefan, that’s a huge help - hadn’t crossed my mind it could be a cert error, given the description. I’m currently using letsencrypt’s certbot to download the certs and symbolic linking to them. Maybe I should just try the generator that the docs recommend, but am wondering if that will present the non-valid CA issues one gets with web browsers (I’m not all that clear on whether this applies to SIP clients or not?!)...

...

On 20 Mar 2017, at 15:36, Stefan Davids <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net>> wrote:

For what it's worth I've had this error when freeswitch couldn't open the required certificates for SSL.

Turning up the freeswitch logging revealed the system call to open the certicate was failing with no such file...

On Fri, March 17, 2017 8:25 pm, Rick Jarvis wrote: > also, the thing that’s really bugging me ATM is that if I enable TLS, just > by setting > the following: > > <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> > > I get: > > 2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for profile: > internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp <>) > The likely causes for this are: > 1) Another application is already listening on the specified address. > 2) The IP the profile is attempting to bind to is not local to this system. > > Yet the TLS port is set to 5061, so how can this be? > > >> On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com >> <mailto:s.safarov@gmail.com>> wrote: >> >> Try NAPTR and SRV records. In this case required only one certificate. >> Requirements sip clients must support NAPRT or SRV records for TLS connection >> >> >> пт, 17 марта 2017, 22:28 Rick Jarvis >> <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com> >> <mailto:rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>>: >> <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net>> >> Trying to get my head around setting TLS up. I have one internal sip profile, >> but >> multiple domains & dialplans. >> >> If I want to enable TLS on multiple domains, I think I’m right in saying >> that I will >> then need multiple sip profiles, in order to set the TLS up in each? >> >> I guess my confusion comes from understanding the difference between domains, >> profiles >> and sip profiles. I’m not even sure exactly what question I’m >> asking here, so >> apologies! >> >> >> _________________________________________________________________________ >> Professional FreeSWITCH Consulting Services: >> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> >> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> >> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>> >> >> Official FreeSWITCH Sites >> http://www.freeswitch.org <http://www.freeswitch.org/> >> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> >> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ >> <http://www.cluecon.com/>> >> >> FreeSWITCH-users mailing list >> FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org> >> <mailto:FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >> <http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >> http://www.freeswitch.org <http://www.freeswitch.org/> >> <http://www.freeswitch.org/ >> <http://www.freeswitch.org/>>_________________________________________________________________________ >> Professional FreeSWITCH Consulting Services: >> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> >> >> Official FreeSWITCH Sites >> http://www.freeswitch.org <http://www.freeswitch.org/> >> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >> http://www.cluecon.com <http://www.cluecon.com/> >> >> FreeSWITCH-users mailing list >> FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org> >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >> http://www.freeswitch.org <http://www.freeswitch.org/> > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org <mailto:consulting@freeswitch.org> > http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> > > Official FreeSWITCH Sites > http://www.freeswitch.org <http://www.freeswitch.org/> > http://confluence.freeswitch.org <http://confluence.freeswitch.org/> > http://www.cluecon.com <http://www.cluecon.com/> > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users> > http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

---

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

I also have DST Root CA X3 on my T48, is working fine for HTTPS. Haven't tried TLS, though. On 4 April 2017 at 16:34, Rick Jarvis <rick@magicmail.mooo.com> wrote:

Ah tshark is telling me:

TLSv1 75 Alert (Level: Fatal, Description: Unknown CA)

And yet I added what I thought was the letsencrypt CA from here:

https://letsencrypt.org/certs/isrgrootx1.pem.txt

The client device is a Yealink T48, number 2 is the above certificate:

On 4 Apr 2017, at 14:07, Stefan Davids <freeswitch@stefan.davids.uk.net> wrote:

Do you have siptrace turned on for that profile?

If that's on and logging nothing check you can see a successful TLS handshake with tshark; eg run

sudo tshark -i any -f "port 5061"

and then get something to try to register (make sure any previous session has timed out). I get, for example:

1 0.000000 82.132.240.202 -> 81.187.168.242 TCP 76 38035→5061 [SYN] Seq=0 Win=14600 Len=0 MSS=1432 SACK_PERM=1 TSval=405135258 TSecr=0 WS=512 2 0.000241 81.187.168.242 -> 82.132.240.202 TCP 76 5061→38035 [SYN, ACK] Seq=0 Ack=1 Win=28800 Len=0 MSS=1452 SACK_PERM=1 TSval=1319863800 TSecr=405135258 WS=128 3 0.028737 82.132.240.202 -> 81.187.168.242 TCP 68 38035→5061 [ACK] Seq=1 Ack=1 Win=14848 Len=0 TSval=405135287 TSecr=1319863800 4 0.029051 82.132.240.202 -> 81.187.168.242 SSL 259 Client Hello 5 0.029207 81.187.168.242 -> 82.132.240.202 TCP 68 5061→38035 [ACK] Seq=1 Ack=192 Win=29952 Len=0 TSval=1319863803 TSecr=405135287 6 0.263779 81.187.168.242 -> 82.132.240.202 TLSv1 1488 Server Hello 7 0.263871 81.187.168.242 -> 82.132.240.202 TLSv1 1488 Certificate 8 0.263944 81.187.168.242 -> 82.132.240.202 TLSv1 635 Server Key Exchange

etc.

I've seen old clients which only support SSLv2 or SSLv3 whereas Freeswitch by default won't (for security reasons). Maybe say what client you're trying to use? It might have some known quirks...

On Tue, April 4, 2017 11:05 am, Rick Jarvis wrote:

I can see it in ngrep, and the conversations look similar to when the register is occurring in TCP, i.e.

phone:randomport -> server:5061 server:5061 -> phone:randomport

But it fails to register as if it’s timing out, and I can’t find any logging on FS to confirm that the conversation took place.

On 3 Apr 2017, at 20:29, David Villasmil <david.villasmil.work@gmail.com> wrote:

If you don't see anything coming in, it's not freeswitch. I mean if you don't see anything with tshark/ngrep , then It's not freeswitch. Look elsewhere...

On Mon, Apr 3, 2017 at 8:53 PM Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com <rick@magicmail.mooo.com>>> wrote: Have to confess I don’t know what wss is? Stefan suggested I cat my certs into wss.pem as per below, which seems to have worked to get the port listening but not sure if that’s what you mean?

I can’t see anything coming in at all, it’s as if the firewall isn’t open on 5061 but it’s open to every port so can’t be that...

On 3 Apr 2017, at 18:42, David Villasmil <david.villasmil.work@gmail.com <mailto:david.villasmil.work@gmail.com <david.villasmil.work@gmail.com>>> wrote:

Do you see registers coming in? If so, check nothing is also listening there, this happened to me once (on a different port) and it was wss, which also shows as freeswitch listening On Mon, Apr 3, 2017 at 7:39 PM Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com <rick@magicmail.mooo.com>>> wrote: This was really helpful, thank you!

Struggling now with the registration over TLS for some reason. sofia shows TLS on 5061, netstat shows listening on port 5061, firewall is completely open, sip internal tls enabled, but whilst handsets register fine on TCP, they timeout on TLS. Is TLS somehow more problematic with NAT traversal maybe? Nothing showing in freeswitch.log, should I be looking elsewhere or increasing the logging maybe?

Thanks again! R

On 21 Mar 2017, at 09:24, Stefan Davids <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net <freeswitch@stefan.davids.uk.net>>> wrote:

It probably depends on the client configuration if you get an invalid certificate for self signed or not. Most seem happy by default when I've tried.

I've had no problems using letsencrypt certificates for TLS.

If it is a certificate issue (you can check by turning up the logging) I'd imagine either the certificate isn't readable by freeswitch (by default I think it'll be chmod 600 and owned by root) or it's wrongly constructed.

I have wss.pem as a symlink

wss.pem -> /etc/letsencrypt/wss.pem

# ls -l /etc/letsencrypt/wss.pem -rw-r----- 1 freeswitch freeswitch 10868 Mar 8 18:46 /etc/letsencrypt/wss.pem

and created wss.pem via

cat /etc/letsencrypt/live/sip.netscum.org.uk/cert.pem <http://sip.netscum.org.uk/cert.pem> /etc/letsencrypt/live/sip.netscum.org.uk/privkey.pem <http://sip.netscum.org.uk/privkey.pem> /etc/letsencrypt/live/sip.netscum.org.uk/chain.pem <http://sip.netscum.org.uk/chain.pem>/etc/letsencrypt/live/ sip.netscum.org.uk/fullchain.pem <http://sip.netscum.org.uk/fullchain.pem> > /etc/letsencrypt/wss.pem

On 20/03/17 22:08, Rick Jarvis wrote:

Thanks Stefan, that’s a huge help - hadn’t crossed my mind it could be a cert error, given the description. I’m currently using letsencrypt’s certbot to download the certs and symbolic linking to them. Maybe I should just try the generator that the docs recommend, but am wondering if that will present the non-valid CA issues one gets with web browsers (I’m not all that clear on whether this applies to SIP clients or not?!)...

On 20 Mar 2017, at 15:36, Stefan Davids <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net <freeswitch@stefan.davids.uk.net>>> wrote:

For what it's worth I've had this error when freeswitch couldn't open the required certificates for SSL.

Turning up the freeswitch logging revealed the system call to open the certicate was failing with no such file...

On Fri, March 17, 2017 8:25 pm, Rick Jarvis wrote:

also, the thing that’s really bugging me ATM is that if I enable TLS, just by setting the following:

<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>

I get:

2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for profile: internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp <>) The likely causes for this are: 1) Another application is already listening on the specified address. 2) The IP the profile is attempting to bind to is not local to this system.

Yet the TLS port is set to 5061, so how can this be?

On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com <mailto:s.safarov@gmail.com <s.safarov@gmail.com>>> wrote:

Try NAPTR and SRV records. In this case required only one certificate. Requirements sip clients must support NAPRT or SRV records for TLS connection

à ¿Ñ‚, 17 à ¼à °Ñ€Ñ‚à ° 2017, 22:28 Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com <rick@magicmail.mooo.com>> <mailto:rick@magicmail.mooo.com <rick@magicmail.mooo.com> < mailto:rick@magicmail.mooo.com <rick@magicmail.mooo.com>>>>: <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net <freeswitch@stefan.davids.uk.net>>> Trying to get my head around setting TLS up. I have one internal sip profile, but multiple domains & dialplans.

If I want to enable TLS on multiple domains, I think I’m right in saying that I will then need multiple sip profiles, in order to set the TLS up in each?

I guess my confusion comes from understanding the difference between domains, profiles and sip profiles. I’m not even sure exactly what question I’m asking here, so apologies!

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> <mailto:consulting@freeswitch.org <consulting@freeswitch.org> < mailto:consulting@freeswitch.org <consulting@freeswitch.org>>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/

...

...

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ <http://www.cluecon.com/>>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> <mailto:FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> <http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users>> http://www.freeswitch.org <http://www.freeswitch.org/> <http://www.freeswitch.org/ <http://www.freeswitch.org/>>_______________________________ __________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@ lists.freeswitch.org <FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>________________________________ _________________________________________

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@ lists.freeswitch.org <FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>________________________________ _________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@ lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org <consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@ lists.freeswitch.org <FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>________________________________ _________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- *Andrew Cassidy BSc (Hons) MBCS SSCA* Managing Director 03303 880 960 andrew@cassidyweb.co.uk <andrew@cassidywebservices.co.uk> www.cassidyweb.co.uk <http://www.cassidywebservices.co.uk>

Try the intermediate as that's what signed your certificate. You can check the chain verifies with openssl; I get: openssl verify -verbose -CApath nosuchdir -CAfile /etc/ssl/certs/DST_Root_CA_X3.pem -untrusted lets-encrypt-x3-cross-signed.pem /opt/freeswitch/certs/wss.pem /opt/freeswitch/certs/wss.pem: OK and openssl verify -verbose -CApath nosuchdir -CAfile isrgrootx1.pem -untrusted letsencryptauthorityx3.pem /opt/freeswitch/certs/wss.pem /opt/freeswitch/certs/wss.pem: OK depending on whether you use the DST root certificate or letsencrypts own. I'd try either of the arguments to -untrusted and see if that works. On Tue, April 4, 2017 11:00 pm, Rick Jarvis wrote:

I guess TLS should be handled the same as https, trust-wise…

This is where CAs get confusing though…

"Our intermediate is signed by ISRG Root X1. However, since we are a very new certificate authority, ISRG Root X1 is not yet trusted in most browsers. In order to be broadly trusted right away, our intermediate is also cross-signed by another certificate authority, IdenTrust, whose root is already trusted in all major browsers. Specifically, IdenTrust has cross-signed our intermediate using their DST Root CA X3 <https://www.identrust.com/certificates/trustid/root-download-x3.html>."

So if I’ve installed ISRG Root X1 that should be the same as installing DST Root CA X3… no?

...

On 4 Apr 2017, at 20:11, Andrew Cassidy <andrew@cassidywebservices.co.uk> wrote:

I also have DST Root CA X3 on my T48, is working fine for HTTPS. Haven't tried TLS, though.

On 4 April 2017 at 16:34, Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>> wrote: Ah tshark is telling me:

TLSv1 75 Alert (Level: Fatal, Description: Unknown CA)

And yet I added what I thought was the letsencrypt CA from here:

https://letsencrypt.org/certs/isrgrootx1.pem.txt <https://letsencrypt.org/certs/isrgrootx1.pem.txt>

The client device is a Yealink T48, number 2 is the above certificate:

<Screenshot 2017-04-04 16.32.32.png>

...

On 4 Apr 2017, at 14:07, Stefan Davids <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net>> wrote:

Do you have siptrace turned on for that profile?

If that's on and logging nothing check you can see a successful TLS handshake with tshark; eg run

sudo tshark -i any -f "port 5061"

and then get something to try to register (make sure any previous session has timed out). I get, for example:

1 0.000000 82.132.240.202 -> 81.187.168.242 TCP 76 38035→5061 [SYN] Seq=0 Win=14600 Len=0 MSS=1432 SACK_PERM=1 TSval=405135258 TSecr=0 WS=512 2 0.000241 81.187.168.242 -> 82.132.240.202 TCP 76 5061→38035 [SYN, ACK] Seq=0 Ack=1 Win=28800 Len=0 MSS=1452 SACK_PERM=1 TSval=1319863800 TSecr=405135258 WS=128 3 0.028737 82.132.240.202 -> 81.187.168.242 TCP 68 38035→5061 [ACK] Seq=1 Ack=1 Win=14848 Len=0 TSval=405135287 TSecr=1319863800 4 0.029051 82.132.240.202 -> 81.187.168.242 SSL 259 Client Hello 5 0.029207 81.187.168.242 -> 82.132.240.202 TCP 68 5061→38035 [ACK] Seq=1 Ack=192 Win=29952 Len=0 TSval=1319863803 TSecr=405135287 6 0.263779 81.187.168.242 -> 82.132.240.202 TLSv1 1488 Server Hello 7 0.263871 81.187.168.242 -> 82.132.240.202 TLSv1 1488 Certificate 8 0.263944 81.187.168.242 -> 82.132.240.202 TLSv1 635 Server Key Exchange

etc.

I've seen old clients which only support SSLv2 or SSLv3 whereas Freeswitch by default won't (for security reasons). Maybe say what client you're trying to use? It might have some known quirks...

On Tue, April 4, 2017 11:05 am, Rick Jarvis wrote:

...

I can see it in ngrep, and the conversations look similar to when the register is occurring in TCP, i.e.

phone:randomport -> server:5061 server:5061 -> phone:randomport

But it fails to register as if it’s timing out, and I can’t find any logging on FS to confirm that the conversation took place.

...

On 3 Apr 2017, at 20:29, David Villasmil <david.villasmil.work@gmail.com <mailto:david.villasmil.work@gmail.com>> wrote:

If you don't see anything coming in, it's not freeswitch. I mean if you don't see anything with tshark/ngrep , then It's not freeswitch. Look elsewhere...

On Mon, Apr 3, 2017 at 8:53 PM Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com> <mailto:rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>> wrote: Have to confess I don’t know what wss is? Stefan suggested I cat my certs into wss.pem as per below, which seems to have worked to get the port listening but not sure if that’s what you mean?

I can’t see anything coming in at all, it’s as if the firewall isn’t open on 5061 but it’s open to every port so can’t be that...

...

On 3 Apr 2017, at 18:42, David Villasmil <david.villasmil.work@gmail.com <mailto:david.villasmil.work@gmail.com> <mailto:david.villasmil.work@gmail.com <mailto:david.villasmil.work@gmail.com>>> wrote:

Do you see registers coming in? If so, check nothing is also listening there, this happened to me once (on a different port) and it was wss, which also shows as freeswitch listening On Mon, Apr 3, 2017 at 7:39 PM Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com> <mailto:rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>> wrote: This was really helpful, thank you!

Struggling now with the registration over TLS for some reason. sofia shows TLS on 5061, netstat shows listening on port 5061, firewall is completely open, sip internal tls enabled, but whilst handsets register fine on TCP, they timeout on TLS. Is TLS somehow more problematic with NAT traversal maybe? Nothing showing in freeswitch.log, should I be looking elsewhere or increasing the logging maybe?

Thanks again! R

> On 21 Mar 2017, at 09:24, Stefan Davids <freeswitch@stefan.davids.uk.net > <mailto:freeswitch@stefan.davids.uk.net> > <mailto:freeswitch@stefan.davids.uk.net > <mailto:freeswitch@stefan.davids.uk.net>>> wrote: >

> > It probably depends on the client configuration if you get an invalid > certificate for self signed or not. Most seem happy by default when > I've tried. > > I've had no problems using letsencrypt certificates for TLS. > > If it is a certificate issue (you can check by turning up the logging) > I'd imagine either the certificate isn't readable by freeswitch (by > default I think it'll be chmod 600 and owned by root) or it's wrongly > constructed. > > I have wss.pem as a symlink > > wss.pem -> /etc/letsencrypt/wss.pem > > # ls -l /etc/letsencrypt/wss.pem > -rw-r----- 1 freeswitch freeswitch 10868 Mar 8 18:46 /etc/letsencrypt/wss.pem > > and created wss.pem via >

> cat /etc/letsencrypt/live/sip.netscum.org.uk/cert.pem > <http://sip.netscum.org.uk/cert.pem> > <http://sip.netscum.org.uk/cert.pem <http://sip.netscum.org.uk/cert.pem>> > /etc/letsencrypt/live/sip.netscum.org.uk/privkey.pem > <http://sip.netscum.org.uk/privkey.pem> > <http://sip.netscum.org.uk/privkey.pem <http://sip.netscum.org.uk/privkey.pem>> > /etc/letsencrypt/live/sip.netscum.org.uk/chain.pem > <http://sip.netscum.org.uk/chain.pem> > <http://sip.netscum.org.uk/chain.pem > <http://sip.netscum.org.uk/chain.pem>>/etc/letsencrypt/live/sip.netscum.org.uk/fullchain.pem > <http://sip.netscum.org.uk/fullchain.pem> > <http://sip.netscum.org.uk/fullchain.pem > <http://sip.netscum.org.uk/fullchain.pem>> > /etc/letsencrypt/wss.pem

> > > > > > On 20/03/17 22:08, Rick Jarvis wrote: >> Thanks Stefan, that’s a huge help - hadn’t crossed my mind it >> could be a cert >> error, given the description. I’m currently using letsencrypt’s >> certbot to >> download the certs and symbolic linking to them. Maybe I should just try the >> generator that the docs recommend, but am wondering if that will present the >> non-valid CA issues one gets with web browsers (I’m not all that clear on >> whether >> this applies to SIP clients or not?!)... >> >>> On 20 Mar 2017, at 15:36, Stefan Davids <freeswitch@stefan.davids.uk.net >>> <mailto:freeswitch@stefan.davids.uk.net> >>> <mailto:freeswitch@stefan.davids.uk.net >>> <mailto:freeswitch@stefan.davids.uk.net>>> wrote: >>> >>> >>> For what it's worth I've had this error when freeswitch couldn't open the >>> required >>> certificates for SSL. >>> >>> Turning up the freeswitch logging revealed the system call to open the >>> certicate >>> was >>> failing with no such file... >>> >>> On Fri, March 17, 2017 8:25 pm, Rick Jarvis wrote: >>>> also, the thing that’s really bugging me ATM is that if I >>>> enable TLS, just >>>> by setting >>>> the following: >>>> >>>> <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> >>>> >>>> I get: >>>> >>>> 2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating SIP UA for >>>> profile: >>>> internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp <> <>) >>>> The likely causes for this are: >>>> 1) Another application is already listening on the specified address. >>>> 2) The IP the profile is attempting to bind to is not local to this system. >>>> >>>> Yet the TLS port is set to 5061, so how can this be? >>>> >>>> >>>>> On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com >>>>> <mailto:s.safarov@gmail.com> >>>>> <mailto:s.safarov@gmail.com <mailto:s.safarov@gmail.com>>> wrote: >>>>> >>>>> Try NAPTR and SRV records. In this case required only one certificate. >>>>> Requirements sip clients must support NAPRT or SRV records for TLS connection >>>>> >>>>> >>>>> à ¿Ñ‚, 17 à ¼à °Ñ€Ñ‚à ° 2017, >>>>> 22:28 Rick Jarvis >>>>> <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com> >>>>> <mailto:rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>> >>>>> <mailto:rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com> >>>>> <mailto:rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com>>>>: >>>>> <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net> >>>>> <mailto:freeswitch@stefan.davids.uk.net >>>>> <mailto:freeswitch@stefan.davids.uk.net>>> >>>>> Trying to get my head around setting TLS up. I have one internal sip profile, >>>>> but >>>>> multiple domains & dialplans. >>>>> >>>>> If I want to enable TLS on multiple domains, I think I’m >>>>> right in saying >>>>> that I will >>>>> then need multiple sip profiles, in order to set the TLS up in each? >>>>> >>>>> I guess my confusion comes from understanding the difference between domains, >>>>> profiles >>>>> and sip profiles. I’m not even sure exactly what question >>>>> I’m >>>>> asking here, so >>>>> apologies! >>>>> >>>>> >>>>> _________________________________________________________________________ >>>>> Professional FreeSWITCH Consulting Services: >>>>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>>> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> >>>>> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>>> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>>> >>>>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> >>>>> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>> >>>>> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/> >>>>> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>>> >>>>> >>>>> Official FreeSWITCH Sites >>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>>> >>>>> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >>>>> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> >>>>> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/> >>>>> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>>> >>>>> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ >>>>> <http://www.cluecon.com/>> <http://www.cluecon.com/ <http://www.cluecon.com/> >>>>> <http://www.cluecon.com/ <http://www.cluecon.com/>>> >>>>> >>>>> FreeSWITCH-users mailing list >>>>> FreeSWITCH-users@lists.freeswitch.org >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>>> >>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>>> >>>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>>> >>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/> >>>>> <http://www.freeswitch.org/ >>>>> <http://www.freeswitch.org/>>>_________________________________________________________________________ >>>>> Professional FreeSWITCH Consulting Services: >>>>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>>> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> >>>>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> >>>>> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>> >>>>> >>>>> Official FreeSWITCH Sites >>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >>>>> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> >>>>> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ >>>>> <http://www.cluecon.com/>> >>>>> >>>>> FreeSWITCH-users mailing list >>>>> FreeSWITCH-users@lists.freeswitch.org >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>> >>>> _________________________________________________________________________ >>>> Professional FreeSWITCH Consulting Services: >>>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> >>>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> >>>> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>> >>>> >>>> Official FreeSWITCH Sites >>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >>>> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> >>>> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ >>>> <http://www.cluecon.com/>> >>>> >>>> FreeSWITCH-users mailing list >>>> FreeSWITCH-users@lists.freeswitch.org >>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>> >>> >>> >>> _________________________________________________________________________ >>> Professional FreeSWITCH Consulting Services: >>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> >>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> >>> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>> >>> >>> Official FreeSWITCH Sites >>> http://www.freeswitch.org <http://www.freeswitch.org/> >>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >>> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> >>> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ >>> <http://www.cluecon.com/>> >>> >>> FreeSWITCH-users mailing list >>> FreeSWITCH-users@lists.freeswitch.org >>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>> http://www.freeswitch.org <http://www.freeswitch.org/> >>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >> >> >> _________________________________________________________________________ >> Professional FreeSWITCH Consulting Services: >> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> >> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> >> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>> >> >> Official FreeSWITCH Sites >> http://www.freeswitch.org <http://www.freeswitch.org/> >> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> >> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ >> <http://www.cluecon.com/>> >> >> FreeSWITCH-users mailing list >> FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org> >> <mailto:FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >> <http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >> http://www.freeswitch.org <http://www.freeswitch.org/> >> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >> > > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org <mailto:consulting@freeswitch.org> > <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> > http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> > <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>> > > Official FreeSWITCH Sites > http://www.freeswitch.org <http://www.freeswitch.org/> > <http://www.freeswitch.org/ <http://www.freeswitch.org/>> > http://confluence.freeswitch.org <http://confluence.freeswitch.org/> > <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> > http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ > <http://www.cluecon.com/>> > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org> > <mailto:FreeSWITCH-users@lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org>> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users> > <http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users>> > http://www.freeswitch.org <http://www.freeswitch.org/> > <http://www.freeswitch.org/ > <http://www.freeswitch.org/>>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ <http://www.cluecon.com/>>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> <mailto:FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> <http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users>> http://www.freeswitch.org <http://www.freeswitch.org/> <http://www.freeswitch.org/ <http://www.freeswitch.org/>>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ <http://www.cluecon.com/>>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> <mailto:FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> <http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users>> http://www.freeswitch.org <http://www.freeswitch.org/> <http://www.freeswitch.org/ <http://www.freeswitch.org/>>

---

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/> <http://www.freeswitchsolutions.com/ <http://www.freeswitchsolutions.com/>>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> <http://confluence.freeswitch.org/ <http://confluence.freeswitch.org/>> http://www.cluecon.com <http://www.cluecon.com/> <http://www.cluecon.com/ <http://www.cluecon.com/>>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> <mailto:FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> <http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users>> http://www.freeswitch.org <http://www.freeswitch.org/> <http://www.freeswitch.org/ <http://www.freeswitch.org/>>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

-- Andrew Cassidy BSc (Hons) MBCS SSCA Managing Director

03303 880 960 andrew@cassidyweb.co.uk <mailto:andrew@cassidywebservices.co.uk> www.cassidyweb.co.uk <http://www.cassidywebservices.co.uk/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

---

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Then the certificate is fine if openssl verifies it. I would try lets-encrypt-x3-cross-signed.pem on its own as that's what signed your certificate. Ultimately there's only 4 possibilities anyway (the two intermediates and the 2 root certificates so it shouldn't be hard to try all combinations). See if you can turn off certificate verification on the client temporarily too just to makes sure it can register then and the sole problem is getting the right trusted certificate loaded. On 05/04/17 18:16, Rick Jarvis wrote:

Ok, so this:

openssl verify -verbose -CAfile letsencrypt-ca.pem -untrusted lets-encrypt-x3-cross-signed.pem /etc/letsencrypt/wss.pem

gives me:

/etc/letsencrypt/wss.pem: OK

Which is what I want I think?! Does that mean I should load both pens onto the handset? Or just the CA?

...

On 5 Apr 2017, at 12:32, Stefan Davids <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net>> wrote:

Try the intermediate as that's what signed your certificate. You can check the chain verifies with openssl; I get:

openssl verify -verbose -CApath nosuchdir -CAfile /etc/ssl/certs/DST_Root_CA_X3.pem -untrusted lets-encrypt-x3-cross-signed.pem /opt/freeswitch/certs/wss.pem /opt/freeswitch/certs/wss.pem: OK

and

openssl verify -verbose -CApath nosuchdir -CAfile isrgrootx1.pem -untrusted letsencryptauthorityx3.pem /opt/freeswitch/certs/wss.pem /opt/freeswitch/certs/wss.pem: OK

depending on whether you use the DST root certificate or letsencrypts own. I'd try either of the arguments to -untrusted and see if that works.

On Tue, April 4, 2017 11:00 pm, Rick Jarvis wrote:

...

I guess TLS should be handled the same as https, trust-wise…

This is where CAs get confusing though…

"Our intermediate is signed by ISRG Root X1. However, since we are a very new certificate authority, ISRG Root X1 is not yet trusted in most browsers. In order to be broadly trusted right away, our intermediate is also cross-signed by another certificate authority, IdenTrust, whose root is already trusted in all major browsers. Specifically, IdenTrust has cross-signed our intermediate using their DST Root CA X3 <https://www.identrust.com/certificates/trustid/root-download-x3.html>."

So if I’ve installed ISRG Root X1 that should be the same as installing DST Root CA X3… no?

...

On 4 Apr 2017, at 20:11, Andrew Cassidy <andrew@cassidywebservices.co.uk <mailto:andrew@cassidywebservices.co.uk>> wrote:

I also have DST Root CA X3 on my T48, is working fine for HTTPS. Haven't tried TLS, though.

On 4 April 2017 at 16:34, Rick Jarvis <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com> <mailto:rick@magicmail.mooo.com>> wrote: Ah tshark is telling me:

TLSv1 75 Alert (Level: Fatal, Description: Unknown CA)

And yet I added what I thought was the letsencrypt CA from here:

https://letsencrypt.org/certs/isrgrootx1.pem.txt <https://letsencrypt.org/certs/isrgrootx1.pem.txt>

The client device is a Yealink T48, number 2 is the above certificate:

<Screenshot 2017-04-04 16.32.32.png>

...

On 4 Apr 2017, at 14:07, Stefan Davids <freeswitch@stefan.davids.uk.net <mailto:freeswitch@stefan.davids.uk.net>> wrote:

Do you have siptrace turned on for that profile?

If that's on and logging nothing check you can see a successful TLS handshake with tshark; eg run

sudo tshark -i any -f "port 5061"

and then get something to try to register (make sure any previous session has timed out). I get, for example:

1 0.000000 82.132.240.202 -> 81.187.168.242 TCP 76 38035→5061 [SYN] Seq=0 Win=14600 Len=0 MSS=1432 SACK_PERM=1 TSval=405135258 TSecr=0 WS=512 2 0.000241 81.187.168.242 -> 82.132.240.202 TCP 76 5061→38035 [SYN, ACK] Seq=0 Ack=1 Win=28800 Len=0 MSS=1452 SACK_PERM=1 TSval=1319863800 TSecr=405135258 WS=128 3 0.028737 82.132.240.202 -> 81.187.168.242 TCP 68 38035→5061 [ACK] Seq=1 Ack=1 Win=14848 Len=0 TSval=405135287 TSecr=1319863800 4 0.029051 82.132.240.202 -> 81.187.168.242 SSL 259 Client Hello 5 0.029207 81.187.168.242 -> 82.132.240.202 TCP 68 5061→38035 [ACK] Seq=1 Ack=192 Win=29952 Len=0 TSval=1319863803 TSecr=405135287 6 0.263779 81.187.168.242 -> 82.132.240.202 TLSv1 1488 Server Hello 7 0.263871 81.187.168.242 -> 82.132.240.202 TLSv1 1488 Certificate 8 0.263944 81.187.168.242 -> 82.132.240.202 TLSv1 635 Server Key Exchange

etc.

I've seen old clients which only support SSLv2 or SSLv3 whereas Freeswitch by default won't (for security reasons). Maybe say what client you're trying to use? It might have some known quirks...

On Tue, April 4, 2017 11:05 am, Rick Jarvis wrote:

...

I can see it in ngrep, and the conversations look similar to when the register is occurring in TCP, i.e.

phone:randomport -> server:5061 server:5061 -> phone:randomport

But it fails to register as if it’s timing out, and I can’t find any logging on FS to confirm that the conversation took place.

> On 3 Apr 2017, at 20:29, David Villasmil > <david.villasmil.work@gmail.com > <mailto:david.villasmil.work@gmail.com>> wrote: > > If you don't see anything coming in, it's not freeswitch. I mean > if you don't see > anything with tshark/ngrep , then It's not freeswitch. Look > elsewhere... > > > On Mon, Apr 3, 2017 at 8:53 PM Rick Jarvis <rick@magicmail.mooo.com > <mailto:rick@magicmail.mooo.com> > <mailto:rick@magicmail.mooo.com > <mailto:rick@magicmail.mooo.com>>> wrote: > Have to confess I don’t know what wss is? Stefan suggested > I cat my certs > into > wss.pem as per below, which seems to have worked to get the port > listening but not > sure if that’s what you mean? > > I can’t see anything coming in at all, it’s as if > the firewall > isn’t open on > 5061 but it’s open to every port so can’t be that... > > >> On 3 Apr 2017, at 18:42, David Villasmil >> <david.villasmil.work@gmail.com >> <mailto:david.villasmil.work@gmail.com> >> <mailto:david.villasmil.work@gmail.com >> <mailto:david.villasmil.work@gmail.com>>> >> wrote: >> >> Do you see registers coming in? If so, check nothing is also >> listening there, this >> happened to me once (on a different port) and it was wss, which >> also shows as >> freeswitch listening >> On Mon, Apr 3, 2017 at 7:39 PM Rick Jarvis <rick@magicmail.mooo.com >> <mailto:rick@magicmail.mooo.com> >> <mailto:rick@magicmail.mooo.com >> <mailto:rick@magicmail.mooo.com>>> wrote: >> This was really helpful, thank you! >> >> Struggling now with the registration over TLS for some reason. >> sofia shows TLS on >> 5061, netstat shows listening on port 5061, firewall is >> completely open, sip >> internal >> tls enabled, but whilst handsets register fine on TCP, they >> timeout on TLS. Is TLS >> somehow more problematic with NAT traversal maybe? Nothing >> showing in >> freeswitch.log, >> should I be looking elsewhere or increasing the logging maybe? >> >> Thanks again! >> R >> >> >>> On 21 Mar 2017, at 09:24, Stefan Davids >>> <freeswitch@stefan.davids.uk.net >>> <mailto:freeswitch@stefan.davids.uk.net> >>> <mailto:freeswitch@stefan.davids.uk.net >>> <mailto:freeswitch@stefan.davids.uk.net>>> wrote: >>> >> >>> >>> It probably depends on the client configuration if you get an >>> invalid >>> certificate for self signed or not. Most seem happy by default >>> when >>> I've tried. >>> >>> I've had no problems using letsencrypt certificates for TLS. >>> >>> If it is a certificate issue (you can check by turning up the >>> logging) >>> I'd imagine either the certificate isn't readable by freeswitch (by >>> default I think it'll be chmod 600 and owned by root) or it's >>> wrongly >>> constructed. >>> >>> I have wss.pem as a symlink >>> >>> wss.pem -> /etc/letsencrypt/wss.pem >>> >>> # ls -l /etc/letsencrypt/wss.pem >>> -rw-r----- 1 freeswitch freeswitch 10868 Mar 8 18:46 >>> /etc/letsencrypt/wss.pem >>> >>> and created wss.pem via >>> >> >>> cat /etc/letsencrypt/live/sip.netscum.org.uk/cert.pem >>> <http://sip.netscum.org.uk/cert.pem> >>> <http://sip.netscum.org.uk/cert.pem >>> <http://sip.netscum.org.uk/cert.pem>> >>> /etc/letsencrypt/live/sip.netscum.org.uk/privkey.pem >>> <http://sip.netscum.org.uk/privkey.pem> >>> <http://sip.netscum.org.uk/privkey.pem >>> <http://sip.netscum.org.uk/privkey.pem>> >>> /etc/letsencrypt/live/sip.netscum.org.uk/chain.pem >>> <http://sip.netscum.org.uk/chain.pem> >>> <http://sip.netscum.org.uk/chain.pem >>> <http://sip.netscum.org.uk/chain.pem>>/etc/letsencrypt/live/sip.netscum.org.uk/fullchain.pem >>> <http://sip.netscum.org.uk/fullchain.pem> >>> <http://sip.netscum.org.uk/fullchain.pem >>> <http://sip.netscum.org.uk/fullchain.pem>> > >>> /etc/letsencrypt/wss.pem >> >>> >>> >>> >>> >>> >>> On 20/03/17 22:08, Rick Jarvis wrote: >>>> Thanks Stefan, that’s a huge help - hadn’t >>>> crossed my mind it >>>> could be a cert >>>> error, given the description. I’m currently using >>>> letsencrypt’s >>>> certbot to >>>> download the certs and symbolic linking to them. Maybe I >>>> should just try the >>>> generator that the docs recommend, but am wondering if that >>>> will present the >>>> non-valid CA issues one gets with web browsers (I’m not >>>> all that clear on >>>> whether >>>> this applies to SIP clients or not?!)... >>>> >>>>> On 20 Mar 2017, at 15:36, Stefan Davids >>>>> <freeswitch@stefan.davids.uk.net >>>>> <mailto:freeswitch@stefan.davids.uk.net> >>>>> <mailto:freeswitch@stefan.davids.uk.net >>>>> <mailto:freeswitch@stefan.davids.uk.net>>> wrote: >>>>> >>>>> >>>>> For what it's worth I've had this error when freeswitch >>>>> couldn't open the >>>>> required >>>>> certificates for SSL. >>>>> >>>>> Turning up the freeswitch logging revealed the system call to >>>>> open the >>>>> certicate >>>>> was >>>>> failing with no such file... >>>>> >>>>> On Fri, March 17, 2017 8:25 pm, Rick Jarvis wrote: >>>>>> also, the thing that’s really bugging me >>>>>> ATM is that if I >>>>>> enable TLS, just >>>>>> by setting >>>>>> the following: >>>>>> >>>>>> <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> >>>>>> >>>>>> I get: >>>>>> >>>>>> 2017-03-17 20:22:05.762756 [ERR] sofia.c:2863 Error Creating >>>>>> SIP UA for >>>>>> profile: >>>>>> internal (sip:mod_sofia@12.34.56.78:5060;transport=udp,tcp >>>>>> <> <>) >>>>>> The likely causes for this are: >>>>>> 1) Another application is already listening on the specified >>>>>> address. >>>>>> 2) The IP the profile is attempting to bind to is not local >>>>>> to this system. >>>>>> >>>>>> Yet the TLS port is set to 5061, so how can this be? >>>>>> >>>>>> >>>>>>> On 17 Mar 2017, at 19:32, Sergey Safarov <s.safarov@gmail.com >>>>>>> <mailto:s.safarov@gmail.com> >>>>>>> <mailto:s.safarov@gmail.com <mailto:s.safarov@gmail.com>>> >>>>>>> wrote: >>>>>>> >>>>>>> Try NAPTR and SRV records. In this case required only one >>>>>>> certificate. >>>>>>> Requirements sip clients must support NAPRT or SRV records >>>>>>> for TLS connection >>>>>>> >>>>>>> >>>>>>> à ¿Ñ‚, 17 à ¼à >>>>>>> °Ñ€Ñ‚à ° 2017, >>>>>>> 22:28 Rick Jarvis >>>>>>> <rick@magicmail.mooo.com <mailto:rick@magicmail.mooo.com> >>>>>>> <mailto:rick@magicmail.mooo.com >>>>>>> <mailto:rick@magicmail.mooo.com>> >>>>>>> <mailto:rick@magicmail.mooo.com >>>>>>> <mailto:rick@magicmail.mooo.com> >>>>>>> <mailto:rick@magicmail.mooo.com >>>>>>> <mailto:rick@magicmail.mooo.com>>>>: >>>>>>> <freeswitch@stefan.davids.uk.net >>>>>>> <mailto:freeswitch@stefan.davids.uk.net> >>>>>>> <mailto:freeswitch@stefan.davids.uk.net >>>>>>> <mailto:freeswitch@stefan.davids.uk.net>>> >>>>>>> Trying to get my head around setting TLS up. I have one >>>>>>> internal sip profile, >>>>>>> but >>>>>>> multiple domains & dialplans. >>>>>>> >>>>>>> If I want to enable TLS on multiple domains, I >>>>>>> think I’m >>>>>>> right in saying >>>>>>> that I will >>>>>>> then need multiple sip profiles, in order to set the TLS up >>>>>>> in each? >>>>>>> >>>>>>> I guess my confusion comes from understanding the >>>>>>> difference between domains, >>>>>>> profiles >>>>>>> and sip profiles. I’m not even sure >>>>>>> exactly what question >>>>>>> I’m >>>>>>> asking here, so >>>>>>> apologies! >>>>>>> >>>>>>> >>>>>>> _________________________________________________________________________ >>>>>>> Professional FreeSWITCH Consulting Services: >>>>>>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>>>>> <mailto:consulting@freeswitch.org >>>>>>> <mailto:consulting@freeswitch.org>> >>>>>>> <mailto:consulting@freeswitch.org >>>>>>> <mailto:consulting@freeswitch.org> >>>>>>> <mailto:consulting@freeswitch.org >>>>>>> <mailto:consulting@freeswitch.org>>> >>>>>>> http://www.freeswitchsolutions.com >>>>>>> <http://www.freeswitchsolutions.com/> >>>>>>> <http://www.freeswitchsolutions.com/ >>>>>>> <http://www.freeswitchsolutions.com/>> >>>>>>> <http://www.freeswitchsolutions.com/ >>>>>>> <http://www.freeswitchsolutions.com/> >>>>>>> <http://www.freeswitchsolutions.com/ >>>>>>> <http://www.freeswitchsolutions.com/>>> >>>>>>> >>>>>>> Official FreeSWITCH Sites >>>>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/> >>>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>>> >>>>>>> http://confluence.freeswitch.org >>>>>>> <http://confluence.freeswitch.org/> >>>>>>> <http://confluence.freeswitch.org/ >>>>>>> <http://confluence.freeswitch.org/>> >>>>>>> <http://confluence.freeswitch.org/ >>>>>>> <http://confluence.freeswitch.org/> >>>>>>> <http://confluence.freeswitch.org/ >>>>>>> <http://confluence.freeswitch.org/>>> >>>>>>> http://www.cluecon.com <http://www.cluecon.com/> >>>>>>> <http://www.cluecon.com/ >>>>>>> <http://www.cluecon.com/>> <http://www.cluecon.com/ >>>>>>> <http://www.cluecon.com/> >>>>>>> <http://www.cluecon.com/ <http://www.cluecon.com/>>> >>>>>>> >>>>>>> FreeSWITCH-users mailing list >>>>>>> FreeSWITCH-users@lists.freeswitch.org >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>>> >>>>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>>> >>>>>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>>> >>>>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/> >>>>>>> <http://www.freeswitch.org/ >>>>>>> <http://www.freeswitch.org/>>>_________________________________________________________________________ >>>>>>> Professional FreeSWITCH Consulting Services: >>>>>>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>>>>> <mailto:consulting@freeswitch.org >>>>>>> <mailto:consulting@freeswitch.org>> >>>>>>> http://www.freeswitchsolutions.com >>>>>>> <http://www.freeswitchsolutions.com/> >>>>>>> <http://www.freeswitchsolutions.com/ >>>>>>> <http://www.freeswitchsolutions.com/>> >>>>>>> >>>>>>> Official FreeSWITCH Sites >>>>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>>>> http://confluence.freeswitch.org >>>>>>> <http://confluence.freeswitch.org/> >>>>>>> <http://confluence.freeswitch.org/ >>>>>>> <http://confluence.freeswitch.org/>> >>>>>>> http://www.cluecon.com <http://www.cluecon.com/> >>>>>>> <http://www.cluecon.com/ >>>>>>> <http://www.cluecon.com/>> >>>>>>> >>>>>>> FreeSWITCH-users mailing list >>>>>>> FreeSWITCH-users@lists.freeswitch.org >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>>>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>>>>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>>>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>>> >>>>>> _________________________________________________________________________ >>>>>> Professional FreeSWITCH Consulting Services: >>>>>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>>>> <mailto:consulting@freeswitch.org >>>>>> <mailto:consulting@freeswitch.org>> >>>>>> http://www.freeswitchsolutions.com >>>>>> <http://www.freeswitchsolutions.com/> >>>>>> <http://www.freeswitchsolutions.com/ >>>>>> <http://www.freeswitchsolutions.com/>> >>>>>> >>>>>> Official FreeSWITCH Sites >>>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>>> http://confluence.freeswitch.org >>>>>> <http://confluence.freeswitch.org/> >>>>>> <http://confluence.freeswitch.org/ >>>>>> <http://confluence.freeswitch.org/>> >>>>>> http://www.cluecon.com <http://www.cluecon.com/> >>>>>> <http://www.cluecon.com/ >>>>>> <http://www.cluecon.com/>> >>>>>> >>>>>> FreeSWITCH-users mailing list >>>>>> FreeSWITCH-users@lists.freeswitch.org >>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>>>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>> >>>>> >>>>> >>>>> _________________________________________________________________________ >>>>> Professional FreeSWITCH Consulting Services: >>>>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>>> <mailto:consulting@freeswitch.org >>>>> <mailto:consulting@freeswitch.org>> >>>>> http://www.freeswitchsolutions.com >>>>> <http://www.freeswitchsolutions.com/> >>>>> <http://www.freeswitchsolutions.com/ >>>>> <http://www.freeswitchsolutions.com/>> >>>>> >>>>> Official FreeSWITCH Sites >>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>>> http://confluence.freeswitch.org >>>>> <http://confluence.freeswitch.org/> >>>>> <http://confluence.freeswitch.org/ >>>>> <http://confluence.freeswitch.org/>> >>>>> http://www.cluecon.com <http://www.cluecon.com/> >>>>> <http://www.cluecon.com/ >>>>> <http://www.cluecon.com/>> >>>>> >>>>> FreeSWITCH-users mailing list >>>>> FreeSWITCH-users@lists.freeswitch.org >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>> >>>> >>>> _________________________________________________________________________ >>>> Professional FreeSWITCH Consulting Services: >>>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>>> <mailto:consulting@freeswitch.org >>>> <mailto:consulting@freeswitch.org>> >>>> http://www.freeswitchsolutions.com >>>> <http://www.freeswitchsolutions.com/> >>>> <http://www.freeswitchsolutions.com/ >>>> <http://www.freeswitchsolutions.com/>> >>>> >>>> Official FreeSWITCH Sites >>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>> http://confluence.freeswitch.org >>>> <http://confluence.freeswitch.org/> >>>> <http://confluence.freeswitch.org/ >>>> <http://confluence.freeswitch.org/>> >>>> http://www.cluecon.com <http://www.cluecon.com/> >>>> <http://www.cluecon.com/ >>>> <http://www.cluecon.com/>> >>>> >>>> FreeSWITCH-users mailing list >>>> FreeSWITCH-users@lists.freeswitch.org >>>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>>> http://www.freeswitch.org <http://www.freeswitch.org/> >>>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>>> >>> >>> >>> _________________________________________________________________________ >>> Professional FreeSWITCH Consulting Services: >>> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >>> <mailto:consulting@freeswitch.org >>> <mailto:consulting@freeswitch.org>> >>> http://www.freeswitchsolutions.com >>> <http://www.freeswitchsolutions.com/> >>> <http://www.freeswitchsolutions.com/ >>> <http://www.freeswitchsolutions.com/>> >>> >>> Official FreeSWITCH Sites >>> http://www.freeswitch.org <http://www.freeswitch.org/> >>> <http://www.freeswitch.org/ <http://www.freeswitch.org/>> >>> http://confluence.freeswitch.org >>> <http://confluence.freeswitch.org/> >>> <http://confluence.freeswitch.org/ >>> <http://confluence.freeswitch.org/>> >>> http://www.cluecon.com <http://www.cluecon.com/> >>> <http://www.cluecon.com/ >>> <http://www.cluecon.com/>> >>> >>> FreeSWITCH-users mailing list >>> FreeSWITCH-users@lists.freeswitch.org >>> <mailto:FreeSWITCH-users@lists.freeswitch.org> >>> <mailto:FreeSWITCH-users@lists.freeswitch.org >>> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >>> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >>> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >>> <http://lists.freeswitch.org/mailman/options/freeswitch-users >>> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >>> http://www.freeswitch.org <http://www.freeswitch.org/> >>> <http://www.freeswitch.org/ >>> <http://www.freeswitch.org/>>_________________________________________________________________________ >> Professional FreeSWITCH Consulting Services: >> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >> <mailto:consulting@freeswitch.org >> <mailto:consulting@freeswitch.org>> >> http://www.freeswitchsolutions.com >> <http://www.freeswitchsolutions.com/> >> <http://www.freeswitchsolutions.com/ >> <http://www.freeswitchsolutions.com/>> >> >> Official FreeSWITCH Sites >> http://www.freeswitch.org <http://www.freeswitch.org/> >> <http://www.freeswitch.org/ >> <http://www.freeswitch.org/>> >> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >> <http://confluence.freeswitch.org/ >> <http://confluence.freeswitch.org/>> >> http://www.cluecon.com <http://www.cluecon.com/> >> <http://www.cluecon.com/ >> <http://www.cluecon.com/>> >> >> FreeSWITCH-users mailing list >> FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org> >> <mailto:FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >> <http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >> http://www.freeswitch.org <http://www.freeswitch.org/> >> <http://www.freeswitch.org/ >> <http://www.freeswitch.org/>>_________________________________________________________________________ >> Professional FreeSWITCH Consulting Services: >> consulting@freeswitch.org <mailto:consulting@freeswitch.org> >> <mailto:consulting@freeswitch.org >> <mailto:consulting@freeswitch.org>> >> http://www.freeswitchsolutions.com >> <http://www.freeswitchsolutions.com/> >> <http://www.freeswitchsolutions.com/ >> <http://www.freeswitchsolutions.com/>> >> >> Official FreeSWITCH Sites >> http://www.freeswitch.org <http://www.freeswitch.org/> >> <http://www.freeswitch.org/ >> <http://www.freeswitch.org/>> >> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> >> <http://confluence.freeswitch.org/ >> <http://confluence.freeswitch.org/>> >> http://www.cluecon.com <http://www.cluecon.com/> >> <http://www.cluecon.com/ >> <http://www.cluecon.com/>> >> >> FreeSWITCH-users mailing list >> FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org> >> <mailto:FreeSWITCH-users@lists.freeswitch.org >> <mailto:FreeSWITCH-users@lists.freeswitch.org>> >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users> >> <http://lists.freeswitch.org/mailman/options/freeswitch-users >> <http://lists.freeswitch.org/mailman/options/freeswitch-users>> >> http://www.freeswitch.org <http://www.freeswitch.org/> >> <http://www.freeswitch.org/ >> <http://www.freeswitch.org/>> > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org <mailto:consulting@freeswitch.org> > <mailto:consulting@freeswitch.org <mailto:consulting@freeswitch.org>> > http://www.freeswitchsolutions.com > <http://www.freeswitchsolutions.com/> > <http://www.freeswitchsolutions.com/ > <http://www.freeswitchsolutions.com/>> > > Official FreeSWITCH Sites > http://www.freeswitch.org <http://www.freeswitch.org/> > <http://www.freeswitch.org/ > <http://www.freeswitch.org/>> > http://confluence.freeswitch.org <http://confluence.freeswitch.org/> > <http://confluence.freeswitch.org/ > <http://confluence.freeswitch.org/>> > http://www.cluecon.com <http://www.cluecon.com/> > <http://www.cluecon.com/ > <http://www.cluecon.com/>> > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org> > <mailto:FreeSWITCH-users@lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org>> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users>> > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users> > <http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users>> > http://www.freeswitch.org <http://www.freeswitch.org/> > <http://www.freeswitch.org/ > <http://www.freeswitch.org/>>_________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org <mailto:consulting@freeswitch.org> > http://www.freeswitchsolutions.com > <http://www.freeswitchsolutions.com/> > > Official FreeSWITCH Sites > http://www.freeswitch.org <http://www.freeswitch.org/> > http://confluence.freeswitch.org <http://confluence.freeswitch.org/> > http://www.cluecon.com <http://www.cluecon.com/> > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > <mailto:FreeSWITCH-users@lists.freeswitch.org> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > <http://lists.freeswitch.org/mailman/options/freeswitch-users> > http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

-- Andrew Cassidy BSc (Hons) MBCS SSCA Managing Director

03303 880 960 andrew@cassidyweb.co.uk <mailto:andrew@cassidywebservices.co.uk> www.cassidyweb.co.uk <http://www.cassidywebservices.co.uk/>_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com <http://www.freeswitchsolutions.com/>

Official FreeSWITCH Sites http://www.freeswitch.org <http://www.freeswitch.org/> http://confluence.freeswitch.org <http://confluence.freeswitch.org/> http://www.cluecon.com <http://www.cluecon.com/>

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users <http://lists.freeswitch.org/mailman/listinfo/freeswitch-users> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users> http://www.freeswitch.org <http://www.freeswitch.org/>

---

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org