Help!! FS -TLS interworking issue, How to config to allow "gentls_cert" to generate a root certificate with more longer valid-period ?
Hi Masters, I'm testing the TLS on FS to work with softphone. followed the wiki (http://wiki.freeswitch.org/wiki/Tls#EyeBeam.2FBria_Setup ), I generated the CA (root) certificate by below command, however, when i install the root certificate on windows,* it prompt me that the valid period is for only one month*. I tried to change the "DAYS=2190" inside the "gentls_cert" script, but it only effect on server certificate(agent.pem) but not root certificate *(cafile.pem*), Could anyone please help me, appreciated for your any advise!! *./gentls_cert setup -cn fs.audiocodes.com.cn -alt DNS:fs.audiocodes.com.cn-org audiocodes.com.cn* * * *below is from wiki. * *This will create CA certificate and key along with in conf/ssl/CA directory(cacert.pem, cakey.pem) and certificate in the conf/ssl folder(cafile.pem).* * [ Note: The name given for -cn and -alt should be the same as the DNS name of your freeswitch installation and used as the registrar name on the phone (at least on Polycoms). ] You can change the "DAYS=2190" line in the gentls_cert file to make the certificate valid for longer time. However making it too long has some wrap around problem, it appears.* *To short, I want to change the valid period longer for the cafile.pem , thanks!!** * -- Regards, Charles
Try running head from GIT and let us know if you still have a problem. ~mitch On Sun, Jul 29, 2012 at 5:25 AM, fieldpeak <fieldpeak@gmail.com> wrote:
Hi Masters,
I'm testing the TLS on FS to work with softphone.
followed the wiki (http://wiki.freeswitch.org/wiki/Tls#EyeBeam.2FBria_Setup),
I generated the CA (root) certificate by below command, however, when i install the root certificate on windows, it prompt me that the valid period is for only one month. I tried to change the "DAYS=2190" inside the "gentls_cert" script, but it only effect on server certificate(agent.pem) but not root certificate (cafile.pem), Could anyone please help me, appreciated for your any advise!!
./gentls_cert setup -cn fs.audiocodes.com.cn -alt DNS:fs.audiocodes.com.cn -org audiocodes.com.cn
below is from wiki.
This will create CA certificate and key along with in conf/ssl/CA directory(cacert.pem, cakey.pem) and certificate in the conf/ssl folder(cafile.pem).
[ Note: The name given for -cn and -alt should be the same as the DNS name of your freeswitch installation and used as the registrar name on the phone (at least on Polycoms). ] You can change the "DAYS=2190" line in the gentls_cert file to make the certificate valid for longer time. However making it too long has some wrap around problem, it appears.
To short, I want to change the valid period longer for the cafile.pem , thanks!!
-- Regards, Charles
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
You do realize that if your org does have an existing PKI infrastructure, you can in theory skip all of that. You just need to know the right values to configure and that's about it. (wink, wink, nudge, nudge) :) On Sun, Jul 29, 2012 at 11:23 AM, Mitch Capper <mitch.capper@gmail.com> wrote:
Try running head from GIT and let us know if you still have a problem.
~mitch
On Sun, Jul 29, 2012 at 5:25 AM, fieldpeak <fieldpeak@gmail.com> wrote:
Hi Masters,
I'm testing the TLS on FS to work with softphone.
followed the wiki (http://wiki.freeswitch.org/wiki/Tls#EyeBeam.2FBria_Setup),
I generated the CA (root) certificate by below command, however, when i install the root certificate on windows, it prompt me that the valid period is for only one month. I tried to change the "DAYS=2190" inside the "gentls_cert" script, but it only effect on server certificate(agent.pem) but not root certificate (cafile.pem), Could anyone please help me, appreciated for your any advise!!
./gentls_cert setup -cn fs.audiocodes.com.cn -alt DNS:fs.audiocodes.com.cn -org audiocodes.com.cn
below is from wiki.
This will create CA certificate and key along with in conf/ssl/CA directory(cacert.pem, cakey.pem) and certificate in the conf/ssl folder(cafile.pem).
[ Note: The name given for -cn and -alt should be the same as the DNS name of your freeswitch installation and used as the registrar name on the phone (at least on Polycoms). ] You can change the "DAYS=2190" line in the gentls_cert file to make the certificate valid for longer time. However making it too long has some wrap around problem, it appears.
To short, I want to change the valid period longer for the cafile.pem , thanks!!
-- Regards, Charles
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Could you please help advise more details？ how should i do to implement your advise... i have very few knowledge about pki, certificate and tls, thanks a lot! :) BR,Charles 在 2012-7-30 上午4:57，"curriegrad2004" <curriegrad2004@gmail.com>写道：
You do realize that if your org does have an existing PKI infrastructure, you can in theory skip all of that. You just need to know the right values to configure and that's about it. (wink, wink, nudge, nudge) :)
On Sun, Jul 29, 2012 at 11:23 AM, Mitch Capper <mitch.capper@gmail.com> wrote:
Try running head from GIT and let us know if you still have a problem.
~mitch
On Sun, Jul 29, 2012 at 5:25 AM, fieldpeak <fieldpeak@gmail.com> wrote:
Hi Masters,
I'm testing the TLS on FS to work with softphone.
followed the wiki (http://wiki.freeswitch.org/wiki/Tls#EyeBeam.2FBria_Setup),
I generated the CA (root) certificate by below command, however, when i install the root certificate on windows, it prompt me that the valid period is for only one month. I tried to change the "DAYS=2190" inside the "gentls_cert" script, but it only effect on server certificate(agent.pem) but not root certificate (cafile.pem), Could anyone please help me, appreciated for your any advise!!
./gentls_cert setup -cn fs.audiocodes.com.cn -alt DNS: fs.audiocodes.com.cn -org audiocodes.com.cn
below is from wiki.
This will create CA certificate and key along with in conf/ssl/CA directory(cacert.pem, cakey.pem) and certificate in the conf/ssl folder(cafile.pem).
[ Note: The name given for -cn and -alt should be the same as the DNS name of your freeswitch installation and used as the registrar name on the phone (at least on Polycoms). ] You can change the "DAYS=2190" line in the gentls_cert file to make the certificate valid for longer time. However making it too long has some wrap around problem, it appears.
To short, I want to change the valid period longer for the cafile.pem , thanks!!
-- Regards, Charles
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Charles, Try the changes in this attached freeswitch/scripts/gentls_cert.in file. There were a few typos in the original script. Regards, Robert From: fieldpeak [mailto:fieldpeak@gmail.com] Sent: Sunday, July 29, 2012 5:57 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] Help!! FS -TLS interworking issue, How to config to allow "gentls_cert" to generate a root certificate with more longer valid-period ? Could you please help advise more details？ how should i do to implement your advise... i have very few knowledge about pki, certificate and tls, thanks a lot! :) BR,Charles 在 2012-7-30 上午4:57，"curriegrad2004" <curriegrad2004@gmail.com<mailto:curriegrad2004@gmail.com>>写道： You do realize that if your org does have an existing PKI infrastructure, you can in theory skip all of that. You just need to know the right values to configure and that's about it. (wink, wink, nudge, nudge) :) On Sun, Jul 29, 2012 at 11:23 AM, Mitch Capper <mitch.capper@gmail.com<mailto:mitch.capper@gmail.com>> wrote:
Try running head from GIT and let us know if you still have a problem.
~mitch
On Sun, Jul 29, 2012 at 5:25 AM, fieldpeak <fieldpeak@gmail.com<mailto:fieldpeak@gmail.com>> wrote:
Hi Masters,
I'm testing the TLS on FS to work with softphone.
followed the wiki (http://wiki.freeswitch.org/wiki/Tls#EyeBeam.2FBria_Setup),
I generated the CA (root) certificate by below command, however, when i install the root certificate on windows, it prompt me that the valid period is for only one month. I tried to change the "DAYS=2190" inside the "gentls_cert" script, but it only effect on server certificate(agent.pem) but not root certificate (cafile.pem), Could anyone please help me, appreciated for your any advise!!
./gentls_cert setup -cn fs.audiocodes.com.cn<http://fs.audiocodes.com.cn> -alt DNS:fs.audiocodes.com.cn<http://fs.audiocodes.com.cn> -org audiocodes.com.cn<http://audiocodes.com.cn>
below is from wiki.
This will create CA certificate and key along with in conf/ssl/CA directory(cacert.pem, cakey.pem) and certificate in the conf/ssl folder(cafile.pem).
[ Note: The name given for -cn and -alt should be the same as the DNS name of your freeswitch installation and used as the registrar name on the phone (at least on Polycoms). ] You can change the "DAYS=2190" line in the gentls_cert file to make the certificate valid for longer time. However making it too long has some wrap around problem, it appears.
To short, I want to change the valid period longer for the cafile.pem , thanks!!
-- Regards, Charles
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On Mon, Jul 30, 2012 at 9:28 AM, Robert Hadley <robert.hadley@teotech.com>wrote:
Hi Charles,****
** **
Try the changes in this attached freeswitch/scripts/gentls_cert.in file. There were a few typos in the original script.****
** **
Regards,****
Robert
I'd like to verify that those typos are indeed really typos and are really fixed. If anyone has input on them please let me know and I will see about getting the gentls_cert.in file updated. I definitely would like to see this tested before we make any updates. Thanks, MC
*Hi All, gentls_cert.in works well, it resolved this problem. Thank you all very much!! [?] Best Regards, Charles * 2012/7/31 Michael Collins <msc@freeswitch.org>
On Mon, Jul 30, 2012 at 9:28 AM, Robert Hadley <robert.hadley@teotech.com>wrote:
Hi Charles,****
** **
Try the changes in this attached freeswitch/scripts/gentls_cert.in file. There were a few typos in the original script.****
** **
Regards,****
Robert
I'd like to verify that those typos are indeed really typos and are really fixed. If anyone has input on them please let me know and I will see about getting the gentls_cert.in file updated. I definitely would like to see this tested before we make any updates.
Thanks, MC
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Regards, Charles
The changes to the attached genttls script verse headis the DAYS was set to 365 instead of 2190 (6 years). In addition the days variable was quoted in two places it was not quoted. 6 years should not be the cause of any problems so we are left with the quoting. I tested across 4 platforms without finding the quoting to be an issue. Robert can you let us know what platform has an issue with the days param not being quoted for days = 2190? ~mitch On Mon, Jul 30, 2012 at 10:07 AM, Michael Collins <msc@freeswitch.org> wrote:
On Mon, Jul 30, 2012 at 9:28 AM, Robert Hadley <robert.hadley@teotech.com> wrote:
Hi Charles,
Try the changes in this attached freeswitch/scripts/gentls_cert.in file. There were a few typos in the original script.
Regards,
Robert
I'd like to verify that those typos are indeed really typos and are really fixed. If anyone has input on them please let me know and I will see about getting the gentls_cert.in file updated. I definitely would like to see this tested before we make any updates.
Thanks, MC
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
The platform Robert and I are using is CentOS 5.7. Jerry -----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Mitch Capper Sent: Wednesday, August 01, 2012 7:57 AM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] Help!! FS -TLS interworking issue, How to config to allow "gentls_cert" to generate a root certificate with more longer valid-period ? The changes to the attached genttls script verse headis the DAYS was set to 365 instead of 2190 (6 years). In addition the days variable was quoted in two places it was not quoted. 6 years should not be the cause of any problems so we are left with the quoting. I tested across 4 platforms without finding the quoting to be an issue. Robert can you let us know what platform has an issue with the days param not being quoted for days = 2190? ~mitch On Mon, Jul 30, 2012 at 10:07 AM, Michael Collins <msc@freeswitch.org> wrote:
On Mon, Jul 30, 2012 at 9:28 AM, Robert Hadley <robert.hadley@teotech.com> wrote:
Hi Charles,
Try the changes in this attached freeswitch/scripts/gentls_cert.in file. There were a few typos in the original script.
Regards,
Robert
I'd like to verify that those typos are indeed really typos and are really fixed. If anyone has input on them please let me know and I will see about getting the gentls_cert.in file updated. I definitely would like to see this tested before we make any updates.
Thanks, MC
______________________________________________________________________ ___ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com Join Us At ClueCon - Aug 7-9, 2012 FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Is anyone else able to confirm a problem on CentOS 5.7 with the genttls_cert from head? I have tried it on CentOS 6 and some pre 5 fedora boxes that all seem to work correctly but I do not have any running CentOS 5. To test run: ./gentls_cert setup && ./gentls_cert create_server openssl x509 -noout -in /usr/local/freeswitch/conf/ssl/agent.pem -enddate openssl x509 -noout -in /usr/local/freeswitch/conf/ssl/cafile.pem -enddate The date should be in 2018. if you get any errors please let us know the error. ~Mitch On Wed, Aug 1, 2012 at 8:12 AM, Jerry Richards <jerry.richards@teotech.com> wrote:
The platform Robert and I are using is CentOS 5.7.
Jerry
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Mitch Capper Sent: Wednesday, August 01, 2012 7:57 AM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] Help!! FS -TLS interworking issue, How to config to allow "gentls_cert" to generate a root certificate with more longer valid-period ?
The changes to the attached genttls script verse headis the DAYS was set to 365 instead of 2190 (6 years). In addition the days variable was quoted in two places it was not quoted. 6 years should not be the cause of any problems so we are left with the quoting. I tested across 4 platforms without finding the quoting to be an issue.
Robert can you let us know what platform has an issue with the days param not being quoted for days = 2190?
~mitch
On Mon, Jul 30, 2012 at 10:07 AM, Michael Collins <msc@freeswitch.org> wrote:
On Mon, Jul 30, 2012 at 9:28 AM, Robert Hadley <robert.hadley@teotech.com> wrote:
Hi Charles,
Try the changes in this attached freeswitch/scripts/gentls_cert.in file. There were a few typos in the original script.
Regards,
Robert
I'd like to verify that those typos are indeed really typos and are really fixed. If anyone has input on them please let me know and I will see about getting the gentls_cert.in file updated. I definitely would like to see this tested before we make any updates.
Thanks, MC
______________________________________________________________________ ___ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
To make it easier I put up a version anyone can grab and it won't trample your existing FS data (installs certs to /tmp/fs_test): wget http://mitchcapper.com/gentls_cert && chmod +x gentls_cert ./gentls_cert setup && ./gentls_cert create_server openssl x509 -noout -in /tmp/fs_test/agent.pem -enddate openssl x509 -noout -in /tmp/fs_test/cafile.pem -enddate Once done just rm /tmp/fs_test and genttls_cert and there will be nothing remaining from the test. ~Mitch On Wed, Aug 1, 2012 at 8:46 AM, Mitch Capper <mitch.capper@gmail.com> wrote:
Is anyone else able to confirm a problem on CentOS 5.7 with the genttls_cert from head? I have tried it on CentOS 6 and some pre 5 fedora boxes that all seem to work correctly but I do not have any running CentOS 5. To test run: ./gentls_cert setup && ./gentls_cert create_server openssl x509 -noout -in /usr/local/freeswitch/conf/ssl/agent.pem -enddate openssl x509 -noout -in /usr/local/freeswitch/conf/ssl/cafile.pem -enddate
The date should be in 2018.
if you get any errors please let us know the error.
~Mitch
On Wed, Aug 1, 2012 at 8:12 AM, Jerry Richards <jerry.richards@teotech.com> wrote:
The platform Robert and I are using is CentOS 5.7.
Jerry
-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Mitch Capper Sent: Wednesday, August 01, 2012 7:57 AM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] Help!! FS -TLS interworking issue, How to config to allow "gentls_cert" to generate a root certificate with more longer valid-period ?
The changes to the attached genttls script verse headis the DAYS was set to 365 instead of 2190 (6 years). In addition the days variable was quoted in two places it was not quoted. 6 years should not be the cause of any problems so we are left with the quoting. I tested across 4 platforms without finding the quoting to be an issue.
Robert can you let us know what platform has an issue with the days param not being quoted for days = 2190?
~mitch
On Mon, Jul 30, 2012 at 10:07 AM, Michael Collins <msc@freeswitch.org> wrote:
On Mon, Jul 30, 2012 at 9:28 AM, Robert Hadley <robert.hadley@teotech.com> wrote:
Hi Charles,
Try the changes in this attached freeswitch/scripts/gentls_cert.in file. There were a few typos in the original script.
Regards,
Robert
I'd like to verify that those typos are indeed really typos and are really fixed. If anyone has input on them please let me know and I will see about getting the gentls_cert.in file updated. I definitely would like to see this tested before we make any updates.
Thanks, MC
______________________________________________________________________ ___ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-use rs http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
Join Us At ClueCon - Aug 7-9, 2012
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On 01-08-12 18:00, Mitch Capper wrote:
To make it easier I put up a version anyone can grab and it won't trample your existing FS data (installs certs to /tmp/fs_test): wget http://mitchcapper.com/gentls_cert && chmod +x gentls_cert ./gentls_cert setup && ./gentls_cert create_server openssl x509 -noout -in /tmp/fs_test/agent.pem -enddate openssl x509 -noout -in /tmp/fs_test/cafile.pem -enddate
Once done just rm /tmp/fs_test and genttls_cert and there will be nothing remaining from the test. ~Mitch
I don't have 5.7 (why would one not update to 5.8?!) but on an up-to-date CentOS 5.8 x86 box I see the following from your script: [patrick@svr2 fs_test]$ openssl x509 -noout -in agent.pem -enddate notAfter=Jul 31 16:48:58 2018 GMT [patrick@svr2 fs_test]$ openssl x509 -noout -in cafile.pem -enddate notAfter=Jul 31 16:48:57 2018 GMT Regards, Patrick
participants (7)
-
curriegrad2004
-
fieldpeak
-
Jerry Richards
-
Michael Collins
-
Mitch Capper
-
Patrick Lists
-
Robert Hadley