So you wanna setup your own CA for WSS/SSL/TLS?
Someone should probably turn this into a nice how-to: Here is how I did it. wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz tar zxfv ssl.ca-0.1.tar.gz cd ssl.ca-0.1/ perl -i -pe 's/md5/sha1/g' *.sh perl -i -pe 's/2048/2048/g' *.sh ./new-root-ca.sh ./new-server-cert.sh self.bkw.org ./sign-server-cert.sh self.bkw.org cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem Setup Apache: default-ssl: SSLCertificateFile /usr/local/freeswitch/certs/wss.pem SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem Setup Sofia TLS: cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/agent.pem cat ca.crt > /usr/local/freeswitch/certs/cafile.pem vars.xml: <X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/> <X-PRE-PROCESS cmd="set" data="external_ssl_enable=true"/> Restart FreeSWITCH. Now make sure your system has ca.crt imported so it will trust your new found hotness. TEST: openssl s_client -connect self.bkw.org:443 openssl s_client -connect self.bkw.org:8082 Depending on what you've setup you'll see: subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web Server/CN= self.bkw.org/emailAddress=brian@bkw.org issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang Bang/OU=Certification Services Division/CN=WBB Root CA/emailAddress= brian@bkw.org Or there abouts. -- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
One correction inline, and did you have any luck getting chrome to work with the custom CA? William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com On 07/25/2014 08:12 AM, Brian West wrote:
Someone should probably turn this into a nice how-to:
Here is how I did it.
wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz tar zxfv ssl.ca-0.1.tar.gz cd ssl.ca-0.1/ perl -i -pe 's/md5/sha1/g' *.sh perl -i -pe 's/2048/2048/g' *.sh This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/ ./new-root-ca.sh ./new-server-cert.sh self.bkw.org <http://self.bkw.org> ./sign-server-cert.sh self.bkw.org <http://self.bkw.org> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem
Setup Apache:
default-ssl:
SSLCertificateFile /usr/local/freeswitch/certs/wss.pem SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem
Setup Sofia TLS:
cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/agent.pem cat ca.crt > /usr/local/freeswitch/certs/cafile.pem
vars.xml:
<X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
Restart FreeSWITCH.
Now make sure your system has ca.crt imported so it will trust your new found hotness.
TEST:
openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082>
Depending on what you've setup you'll see:
subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web Server/CN=self.bkw.org/emailAddress=brian@bkw.org <http://self.bkw.org/emailAddress=brian@bkw.org>
issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang Bang/OU=Certification Services Division/CN=WBB Root CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org>
Or there abouts.
--
*/Brian West/* brian@freeswitch.org <mailto:brian@freeswitch.org>
*/Twitter: @FreeSWITCH , @briankwest/* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I've corrected the how-to and put it in tree: https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to... Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out. If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE. On Fri, Jul 25, 2014 at 1:53 PM, William King <william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work with the custom CA?
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 07/25/2014 08:12 AM, Brian West wrote:
Someone should probably turn this into a nice how-to:
Here is how I did it.
wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz tar zxfv ssl.ca-0.1.tar.gz cd ssl.ca-0.1/ perl -i -pe 's/md5/sha1/g' *.sh perl -i -pe 's/2048/2048/g' *.sh This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/ ./new-root-ca.sh ./new-server-cert.sh self.bkw.org <http://self.bkw.org> ./sign-server-cert.sh self.bkw.org <http://self.bkw.org> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem
Setup Apache:
default-ssl:
SSLCertificateFile /usr/local/freeswitch/certs/wss.pem SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem
Setup Sofia TLS:
cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/agent.pem cat ca.crt > /usr/local/freeswitch/certs/cafile.pem
vars.xml:
<X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
Restart FreeSWITCH.
Now make sure your system has ca.crt imported so it will trust your new found hotness.
TEST:
openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082>
Depending on what you've setup you'll see:
subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web Server/CN=self.bkw.org/emailAddress=brian@bkw.org <http://self.bkw.org/emailAddress=brian@bkw.org>
issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang Bang/OU=Certification Services Division/CN=WBB Root CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org>
Or there abouts.
--
*/Brian West/* brian@freeswitch.org <mailto:brian@freeswitch.org>
*/Twitter: @FreeSWITCH , @briankwest/* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
Doing these exact steps don't seem to work for me, but WS sockets work perfectly so using that for now instead of WSS! Actually it might not even be a certificate issue, FS tells me: 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:3209 192.168.10.80:41210 Client Connect. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1379 192.168.10.80:41210 Starting client thread. 2014-08-05 16:44:11.831823 [DEBUG] mod_verto.c:1292 192.168.10.80:41210 WS SETUP FAILED 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1405 192.168.10.80:41210 Ending client thread. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1412 192.168.10.80:41210 Thread ended Which doesn't necessarily point to a TLS issue! Is importing the CA certificate in the client a necessary step to make it work with Chrome? François On Fri, 2014-07-25 at 13:59 -0500, Brian West wrote:
I've corrected the how-to and put it in tree:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to...
Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out. If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE.
On Fri, Jul 25, 2014 at 1:53 PM, William King <william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work with the custom CA?
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 07/25/2014 08:12 AM, Brian West wrote: > Someone should probably turn this into a nice how-to: > > Here is how I did it. > > wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz > tar zxfv ssl.ca-0.1.tar.gz > cd ssl.ca-0.1/ > perl -i -pe 's/md5/sha1/g' *.sh > perl -i -pe 's/2048/2048/g' *.sh
This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/ > ./new-root-ca.sh > ./new-server-cert.sh self.bkw.org <http://self.bkw.org> > ./sign-server-cert.sh self.bkw.org <http://self.bkw.org>
> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem > > Setup Apache: > > default-ssl: > > SSLCertificateFile /usr/local/freeswitch/certs/wss.pem > SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem > SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem > > Setup Sofia TLS: > > cat self.bkw.org.crt self.bkw.org.key > > /usr/local/freeswitch/certs/agent.pem > cat ca.crt > /usr/local/freeswitch/certs/cafile.pem > > vars.xml: > > <X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/>
> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
> > Restart FreeSWITCH. > > Now make sure your system has ca.crt imported so it will trust your new > found hotness. > > TEST: >
> openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> > openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082>
> > > Depending on what you've setup you'll see: > > subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web > Server/CN=self.bkw.org/emailAddress=brian@bkw.org
> <http://self.bkw.org/emailAddress=brian@bkw.org>
> > issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang > Bang/OU=Certification Services Division/CN=WBB Root
> CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org> > > Or there abouts. > > -- > > */Brian West/* > brian@freeswitch.org <mailto:brian@freeswitch.org> > > > */Twitter: @FreeSWITCH , @briankwest/* > http://www.freeswitchbook.com > http://www.freeswitchcookbook.com > > *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) > *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest > > > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org > http://www.freeswitchsolutions.com > > FreeSWITCH-powered IP PBX: The CudaTel Communication Server > http://www.cudatel.com > > Official FreeSWITCH Sites > http://www.freeswitch.org > http://wiki.freeswitch.org > http://www.cluecon.com > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org >
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
Brian West brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Just found out the reason for my troubles! It was not a certificate issue. The latest google Chrome (36) installed in debian wheezy/stable does not support TLS 1.2 because it requires libnss >3.15 (wheezy has 3.14). Unfortunately freeswitch requires TLS 1.2 for WSS connections. Any way to authorize TLS 1.1 or is it too insecure for web sockets? --- A workaround in debian wheezy would be to install the a recent Firefox that support TLS 1.2. Keep in mind that mod_verto stopped working since Firefox 31 (see FS-6708), but older versions should work fine! François On Tue, 2014-08-05 at 16:51 +0200, François Delawarde wrote:
Doing these exact steps don't seem to work for me, but WS sockets work perfectly so using that for now instead of WSS!
Actually it might not even be a certificate issue, FS tells me:
2014-08-05 16:44:11.831823 [INFO] mod_verto.c:3209 192.168.10.80:41210 Client Connect. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1379 192.168.10.80:41210 Starting client thread. 2014-08-05 16:44:11.831823 [DEBUG] mod_verto.c:1292 192.168.10.80:41210 WS SETUP FAILED 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1405 192.168.10.80:41210 Ending client thread. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1412 192.168.10.80:41210 Thread ended
Which doesn't necessarily point to a TLS issue!
Is importing the CA certificate in the client a necessary step to make it work with Chrome?
François
On Fri, 2014-07-25 at 13:59 -0500, Brian West wrote:
I've corrected the how-to and put it in tree:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to...
Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out. If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE.
On Fri, Jul 25, 2014 at 1:53 PM, William King <william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work with the custom CA?
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 07/25/2014 08:12 AM, Brian West wrote: > Someone should probably turn this into a nice how-to: > > Here is how I did it. > > wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz > tar zxfv ssl.ca-0.1.tar.gz > cd ssl.ca-0.1/ > perl -i -pe 's/md5/sha1/g' *.sh > perl -i -pe 's/2048/2048/g' *.sh
This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/ > ./new-root-ca.sh > ./new-server-cert.sh self.bkw.org <http://self.bkw.org> > ./sign-server-cert.sh self.bkw.org <http://self.bkw.org> > cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem > > Setup Apache: > > default-ssl: > > SSLCertificateFile /usr/local/freeswitch/certs/wss.pem > SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem > SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem > > Setup Sofia TLS: > > cat self.bkw.org.crt self.bkw.org.key > > /usr/local/freeswitch/certs/agent.pem > cat ca.crt > /usr/local/freeswitch/certs/cafile.pem > > vars.xml: > > <X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/>
> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/> > > Restart FreeSWITCH. > > Now make sure your system has ca.crt imported so it will trust your new > found hotness. > > TEST: >
> openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> > openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082> > > > Depending on what you've setup you'll see: > > subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web > Server/CN=self.bkw.org/emailAddress=brian@bkw.org
> <http://self.bkw.org/emailAddress=brian@bkw.org> > > issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang > Bang/OU=Certification Services Division/CN=WBB Root
> CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org> > > Or there abouts. > > -- > > */Brian West/* > brian@freeswitch.org <mailto:brian@freeswitch.org> > > > */Twitter: @FreeSWITCH , @briankwest/* > http://www.freeswitchbook.com > http://www.freeswitchcookbook.com > > *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) > *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest > > > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org > http://www.freeswitchsolutions.com > > FreeSWITCH-powered IP PBX: The CudaTel Communication Server > http://www.cudatel.com > > Official FreeSWITCH Sites > http://www.freeswitch.org > http://wiki.freeswitch.org > http://www.cluecon.com > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org >
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Brian West brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
TLS shouldn't be required for non secure WS transport. This sounds like a browser issue to me. On Wed, Aug 6, 2014 at 5:37 AM, François Delawarde < fdelawarde@wirelessmundi.com> wrote:
Just found out the reason for my troubles! It was not a certificate issue.
The latest google Chrome (36) installed in debian wheezy/stable does not support TLS 1.2 because it requires libnss >3.15 (wheezy has 3.14). Unfortunately freeswitch requires TLS 1.2 for WSS connections.
Any way to authorize TLS 1.1 or is it too insecure for web sockets?
---
A workaround in debian wheezy would be to install the a recent Firefox that support TLS 1.2. Keep in mind that mod_verto stopped working since Firefox 31 (see FS-6708), but older versions should work fine!
François
On Tue, 2014-08-05 at 16:51 +0200, François Delawarde wrote:
Doing these exact steps don't seem to work for me, but WS sockets work perfectly so using that for now instead of WSS!
Actually it might not even be a certificate issue, FS tells me:
2014-08-05 16:44:11.831823 [INFO] mod_verto.c:3209 192.168.10.80:41210 Client Connect. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1379 192.168.10.80:41210 Starting client thread. 2014-08-05 16:44:11.831823 [DEBUG] mod_verto.c:1292 192.168.10.80:41210 WS SETUP FAILED 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1405 192.168.10.80:41210 Ending client thread. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1412 192.168.10.80:41210 Thread ended
Which doesn't necessarily point to a TLS issue!
Is importing the CA certificate in the client a necessary step to make it work with Chrome?
François
On Fri, 2014-07-25 at 13:59 -0500, Brian West wrote:
I've corrected the how-to and put it in tree:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to...
Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out. If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE.
On Fri, Jul 25, 2014 at 1:53 PM, William King < william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work with the custom CA?
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 07/25/2014 08:12 AM, Brian West wrote:
Someone should probably turn this into a nice how-to:
Here is how I did it.
wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz tar zxfv ssl.ca-0.1.tar.gz cd ssl.ca-0.1/ perl -i -pe 's/md5/sha1/g' *.sh perl -i -pe 's/2048/2048/g' *.sh
This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/
./new-root-ca.sh ./new-server-cert.sh self.bkw.org <http://self.bkw.org> ./sign-server-cert.sh self.bkw.org <http://self.bkw.org> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem
Setup Apache:
default-ssl:
SSLCertificateFile /usr/local/freeswitch/certs/wss.pem SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem
Setup Sofia TLS:
cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/agent.pem cat ca.crt > /usr/local/freeswitch/certs/cafile.pem
vars.xml:
<X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/>
<X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
Restart FreeSWITCH.
Now make sure your system has ca.crt imported so it will trust your new found hotness.
TEST:
openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082>
Depending on what you've setup you'll see:
subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web Server/CN=self.bkw.org/emailAddress=brian@bkw.org
<http://self.bkw.org/emailAddress=brian@bkw.org>
issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang Bang/OU=Certification Services Division/CN=WBB Root
CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org>
Or there abouts.
--
*/Brian West/* brian@freeswitch.org <mailto:brian@freeswitch.org>
*/Twitter: @FreeSWITCH , @briankwest/* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com
Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com
FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com
Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com
FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Brian West* brian@freeswitch.org *Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com *T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
I was of course talking about WSS. The issue is that not all browsers support TLS 1.2 (required by FreeSWITCH), see explanation below! François. On Wed, 2014-08-06 at 07:12 -0500, Brian West wrote:
TLS shouldn't be required for non secure WS transport. This sounds like a browser issue to me.
On Wed, Aug 6, 2014 at 5:37 AM, François Delawarde <fdelawarde@wirelessmundi.com> wrote:
Just found out the reason for my troubles! It was not a certificate issue.
The latest google Chrome (36) installed in debian wheezy/stable does not support TLS 1.2 because it requires libnss >3.15 (wheezy has 3.14). Unfortunately freeswitch requires TLS 1.2 for WSS connections.
Any way to authorize TLS 1.1 or is it too insecure for web sockets?
---
A workaround in debian wheezy would be to install the a recent Firefox that support TLS 1.2. Keep in mind that mod_verto stopped working since Firefox 31 (see FS-6708), but older versions should work fine!
François
On Tue, 2014-08-05 at 16:51 +0200, François Delawarde wrote:
> Doing these exact steps don't seem to work for me, but WS > sockets work perfectly so using that for now instead of WSS! > > Actually it might not even be a certificate issue, FS tells > me: > > 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:3209 > 192.168.10.80:41210 Client Connect. > 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1379 > 192.168.10.80:41210 Starting client thread. > 2014-08-05 16:44:11.831823 [DEBUG] mod_verto.c:1292 > 192.168.10.80:41210 WS SETUP FAILED > 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1405 > 192.168.10.80:41210 Ending client thread. > 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1412 > 192.168.10.80:41210 Thread ended > > Which doesn't necessarily point to a TLS issue! > > Is importing the CA certificate in the client a necessary > step to make it work with Chrome? > > François > > > > On Fri, 2014-07-25 at 13:59 -0500, Brian West wrote: > > > I've corrected the how-to and put it in tree: > > > > > > https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to... > > > > > > > > Importing the ca.crt into your system keychain for it to > > be trusted is left to the end user to figure out. If you > > can't do that step then you'll kinda be SOL, I know on my > > Mac I just open ca.crt and it does the import for me... > > Windows I suspect is similar as for Linux NO CLUE. > > > > > > On Fri, Jul 25, 2014 at 1:53 PM, William King > > <william.king@quentustech.com> wrote: > > > > One correction inline, and did you have any luck > > getting chrome to work > > with the custom CA? > > > > William King > > Senior Engineer > > Quentus Technologies, INC > > 1037 NE 65th St Suite 273 > > Seattle, WA 98115 > > Main: (877) 211-9337 > > Office: (206) 388-4772 > > Cell: (253) 686-5518 > > william.king@quentustech.com > > > > On 07/25/2014 08:12 AM, Brian West wrote: > > > Someone should probably turn this into a nice > > how-to: > > > > > > Here is how I did it. > > > > > > wget > > http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz > > > tar zxfv ssl.ca-0.1.tar.gz > > > cd ssl.ca-0.1/ > > > perl -i -pe 's/md5/sha1/g' *.sh > > > perl -i -pe 's/2048/2048/g' *.sh > > > > This is a noop. I assume it was suppose to > > be /2048/4096/ or /1024/2048/ > > > ./new-root-ca.sh > > > ./new-server-cert.sh self.bkw.org > > <http://self.bkw.org> > > > ./sign-server-cert.sh self.bkw.org > > <http://self.bkw.org> > > > cat self.bkw.org.crt self.bkw.org.key > > > /usr/local/freeswitch/certs/wss.pem > > > > > > Setup Apache: > > > > > > default-ssl: > > > > > > SSLCertificateFile > > /usr/local/freeswitch/certs/wss.pem > > > > > SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem > > > > > SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem > > > > > > Setup Sofia TLS: > > > > > > cat self.bkw.org.crt self.bkw.org.key > > > > /usr/local/freeswitch/certs/agent.pem > > > cat ca.crt > > > /usr/local/freeswitch/certs/cafile.pem > > > > > > vars.xml: > > > > > > > > <X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/> > > > > > > > <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/> > > > > > > Restart FreeSWITCH. > > > > > > Now make sure your system has ca.crt imported so > > it will trust your new > > > found hotness. > > > > > > TEST: > > > > > > > > openssl s_client -connect self.bkw.org:443 > > <http://self.bkw.org:443> > > > openssl s_client -connect self.bkw.org:8082 > > <http://self.bkw.org:8082> > > > > > > > > > Depending on what you've setup you'll see: > > > > > > subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka > > Truck/OU=Secure Web > > > > > Server/CN=self.bkw.org/emailAddress=brian@bkw.org > > > > > > > <http://self.bkw.org/emailAddress=brian@bkw.org> > > > > > > > > issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy > > Bang > > > Bang/OU=Certification Services Division/CN=WBB > > Root > > > > > CA/emailAddress=brian@bkw.org > > <mailto:brian@bkw.org> > > > > > > Or there abouts. > > > > > > -- > > > > > > */Brian West/* > > > brian@freeswitch.org > > <mailto:brian@freeswitch.org> > > > > > > > > > */Twitter: @FreeSWITCH , @briankwest/* > > > http://www.freeswitchbook.com > > > http://www.freeswitchcookbook.com > > > > > > *T:*+19184209001 | *F:*+19184209002 | *M:* > > +1918424WEST (9378) > > > *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | > > *Skype:*briankwest > > > > > > > > > > > > > > _________________________________________________________________________ > > > Professional FreeSWITCH Consulting Services: > > > consulting@freeswitch.org > > > http://www.freeswitchsolutions.com > > > > > > FreeSWITCH-powered IP PBX: The CudaTel > > Communication Server > > > http://www.cudatel.com > > > > > > Official FreeSWITCH Sites > > > http://www.freeswitch.org > > > http://wiki.freeswitch.org > > > http://www.cluecon.com > > > > > > FreeSWITCH-users mailing list > > > FreeSWITCH-users@lists.freeswitch.org > > > > > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > > > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > > > http://www.freeswitch.org > > > > > > > _________________________________________________________________________ > > Professional FreeSWITCH Consulting Services: > > consulting@freeswitch.org > > http://www.freeswitchsolutions.com > > > > FreeSWITCH-powered IP PBX: The CudaTel > > Communication Server > > http://www.cudatel.com > > > > Official FreeSWITCH Sites > > http://www.freeswitch.org > > http://wiki.freeswitch.org > > http://www.cluecon.com > > > > FreeSWITCH-users mailing list > > FreeSWITCH-users@lists.freeswitch.org > > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > > http://www.freeswitch.org > > > > > > > > > > > > > > -- > > Brian West > > brian@freeswitch.org > > > > > > > > > > Twitter: @FreeSWITCH , @briankwest > > http://www.freeswitchbook.com > > http://www.freeswitchcookbook.com > > > > T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) > > iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest > > > > > > > > _________________________________________________________________________ > > Professional FreeSWITCH Consulting Services: > > consulting@freeswitch.org > > http://www.freeswitchsolutions.com > > > > FreeSWITCH-powered IP PBX: The CudaTel Communication Server > > http://www.cudatel.com > > > > Official FreeSWITCH Sites > > http://www.freeswitch.org > > http://wiki.freeswitch.org > > http://www.cluecon.com > > > > FreeSWITCH-users mailing list > > FreeSWITCH-users@lists.freeswitch.org > > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > > http://www.freeswitch.org > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org > http://www.freeswitchsolutions.com > > FreeSWITCH-powered IP PBX: The CudaTel Communication Server > http://www.cudatel.com > > Official FreeSWITCH Sites > http://www.freeswitch.org > http://wiki.freeswitch.org > http://www.cluecon.com > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
Brian West brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
See also FS-6727: https://jira.freeswitch.org/browse/FS-6727 François. On Wed, 2014-08-06 at 15:07 +0200, François Delawarde wrote:
I was of course talking about WSS. The issue is that not all browsers support TLS 1.2 (required by FreeSWITCH), see explanation below!
François.
On Wed, 2014-08-06 at 07:12 -0500, Brian West wrote:
TLS shouldn't be required for non secure WS transport. This sounds like a browser issue to me.
On Wed, Aug 6, 2014 at 5:37 AM, François Delawarde <fdelawarde@wirelessmundi.com> wrote:
Just found out the reason for my troubles! It was not a certificate issue.
The latest google Chrome (36) installed in debian wheezy/stable does not support TLS 1.2 because it requires libnss >3.15 (wheezy has 3.14). Unfortunately freeswitch requires TLS 1.2 for WSS connections.
Any way to authorize TLS 1.1 or is it too insecure for web sockets?
---
A workaround in debian wheezy would be to install the a recent Firefox that support TLS 1.2. Keep in mind that mod_verto stopped working since Firefox 31 (see FS-6708), but older versions should work fine!
François
On Tue, 2014-08-05 at 16:51 +0200, François Delawarde wrote:
> Doing these exact steps don't seem to work for me, but WS > sockets work perfectly so using that for now instead of > WSS! > > Actually it might not even be a certificate issue, FS > tells me: > > 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:3209 > 192.168.10.80:41210 Client Connect. > 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1379 > 192.168.10.80:41210 Starting client thread. > 2014-08-05 16:44:11.831823 [DEBUG] mod_verto.c:1292 > 192.168.10.80:41210 WS SETUP FAILED > 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1405 > 192.168.10.80:41210 Ending client thread. > 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1412 > 192.168.10.80:41210 Thread ended > > Which doesn't necessarily point to a TLS issue! > > Is importing the CA certificate in the client a necessary > step to make it work with Chrome? > > François > > > > > On Fri, 2014-07-25 at 13:59 -0500, Brian West wrote: > > > I've corrected the how-to and put it in tree: > > > > > > https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to... > > > > > > > > Importing the ca.crt into your system keychain for it to > > be trusted is left to the end user to figure out. If > > you can't do that step then you'll kinda be SOL, I know > > on my Mac I just open ca.crt and it does the import for > > me... Windows I suspect is similar as for Linux NO CLUE. > > > > > > On Fri, Jul 25, 2014 at 1:53 PM, William King > > <william.king@quentustech.com> wrote: > > > > One correction inline, and did you have any luck > > getting chrome to work > > with the custom CA? > > > > William King > > Senior Engineer > > Quentus Technologies, INC > > 1037 NE 65th St Suite 273 > > Seattle, WA 98115 > > Main: (877) 211-9337 > > Office: (206) 388-4772 > > Cell: (253) 686-5518 > > william.king@quentustech.com > > > > On 07/25/2014 08:12 AM, Brian West wrote: > > > Someone should probably turn this into a nice > > how-to: > > > > > > Here is how I did it. > > > > > > wget > > http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz > > > tar zxfv ssl.ca-0.1.tar.gz > > > cd ssl.ca-0.1/ > > > perl -i -pe 's/md5/sha1/g' *.sh > > > perl -i -pe 's/2048/2048/g' *.sh > > > > This is a noop. I assume it was suppose to > > be /2048/4096/ or /1024/2048/ > > > ./new-root-ca.sh > > > ./new-server-cert.sh self.bkw.org > > <http://self.bkw.org> > > > ./sign-server-cert.sh self.bkw.org > > <http://self.bkw.org> > > > cat self.bkw.org.crt self.bkw.org.key > > > /usr/local/freeswitch/certs/wss.pem > > > > > > Setup Apache: > > > > > > default-ssl: > > > > > > SSLCertificateFile > > /usr/local/freeswitch/certs/wss.pem > > > > > SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem > > > > > SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem > > > > > > Setup Sofia TLS: > > > > > > cat self.bkw.org.crt self.bkw.org.key > > > > /usr/local/freeswitch/certs/agent.pem > > > cat ca.crt > > > /usr/local/freeswitch/certs/cafile.pem > > > > > > vars.xml: > > > > > > > > <X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/> > > > > > > > <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/> > > > > > > Restart FreeSWITCH. > > > > > > Now make sure your system has ca.crt imported > > so it will trust your new > > > found hotness. > > > > > > TEST: > > > > > > > > openssl s_client -connect self.bkw.org:443 > > <http://self.bkw.org:443> > > > openssl s_client -connect self.bkw.org:8082 > > <http://self.bkw.org:8082> > > > > > > > > > Depending on what you've setup you'll see: > > > > > > subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka > > Truck/OU=Secure Web > > > > > Server/CN=self.bkw.org/emailAddress=brian@bkw.org > > > > > > > <http://self.bkw.org/emailAddress=brian@bkw.org> > > > > > > > > issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang > > > Bang/OU=Certification Services Division/CN=WBB > > Root > > > > > CA/emailAddress=brian@bkw.org > > <mailto:brian@bkw.org> > > > > > > Or there abouts. > > > > > > -- > > > > > > */Brian West/* > > > brian@freeswitch.org > > <mailto:brian@freeswitch.org> > > > > > > > > > */Twitter: @FreeSWITCH , @briankwest/* > > > http://www.freeswitchbook.com > > > http://www.freeswitchcookbook.com > > > > > > *T:*+19184209001 | *F:*+19184209002 | *M:* > > +1918424WEST (9378) > > > *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | > > *Skype:*briankwest > > > > > > > > > > > > > > _________________________________________________________________________ > > > Professional FreeSWITCH Consulting Services: > > > consulting@freeswitch.org > > > http://www.freeswitchsolutions.com > > > > > > FreeSWITCH-powered IP PBX: The CudaTel > > Communication Server > > > http://www.cudatel.com > > > > > > Official FreeSWITCH Sites > > > http://www.freeswitch.org > > > http://wiki.freeswitch.org > > > http://www.cluecon.com > > > > > > FreeSWITCH-users mailing list > > > FreeSWITCH-users@lists.freeswitch.org > > > > > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > > > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > > > http://www.freeswitch.org > > > > > > > _________________________________________________________________________ > > Professional FreeSWITCH Consulting Services: > > consulting@freeswitch.org > > http://www.freeswitchsolutions.com > > > > FreeSWITCH-powered IP PBX: The CudaTel > > Communication Server > > http://www.cudatel.com > > > > Official FreeSWITCH Sites > > http://www.freeswitch.org > > http://wiki.freeswitch.org > > http://www.cluecon.com > > > > FreeSWITCH-users mailing list > > FreeSWITCH-users@lists.freeswitch.org > > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > > http://www.freeswitch.org > > > > > > > > > > > > > > -- > > Brian West > > brian@freeswitch.org > > > > > > > > > > Twitter: @FreeSWITCH , @briankwest > > http://www.freeswitchbook.com > > http://www.freeswitchcookbook.com > > > > T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) > > iNUM:+883 5100 1420 9001 | ISN:410*543 > > | Skype:briankwest > > > > > > > > _________________________________________________________________________ > > Professional FreeSWITCH Consulting Services: > > consulting@freeswitch.org > > http://www.freeswitchsolutions.com > > > > FreeSWITCH-powered IP PBX: The CudaTel Communication Server > > http://www.cudatel.com > > > > Official FreeSWITCH Sites > > http://www.freeswitch.org > > http://wiki.freeswitch.org > > http://www.cluecon.com > > > > FreeSWITCH-users mailing list > > FreeSWITCH-users@lists.freeswitch.org > > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > > http://www.freeswitch.org > > _________________________________________________________________________ > Professional FreeSWITCH Consulting Services: > consulting@freeswitch.org > http://www.freeswitchsolutions.com > > FreeSWITCH-powered IP PBX: The CudaTel Communication Server > http://www.cudatel.com > > Official FreeSWITCH Sites > http://www.freeswitch.org > http://wiki.freeswitch.org > http://www.cluecon.com > > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Brian West brian@freeswitch.org
Twitter: @FreeSWITCH , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com
T:+19184209001 | F:+19184209002 | M:+1918424WEST (9378) iNUM:+883 5100 1420 9001 | ISN:410*543 | Skype:briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Brian, I used your script to generate the certificates to test mod_verto in an intranet setup. Questions on your script: 1) Is 4096 bits required? Or 2048 bits will work, too? 2) Examining certs/wss.pem, there should be a <chain> certificate at the end. But the script, inputs only 2 - *.crt and *.key. What should be the 3rd? Tks, /Nandy On Sat, Jul 26, 2014 at 2:59 AM, Brian West <brian@freeswitch.org> wrote:
I've corrected the how-to and put it in tree:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to...
Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out. If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE.
On Fri, Jul 25, 2014 at 1:53 PM, William King < william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work with the custom CA?
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 07/25/2014 08:12 AM, Brian West wrote:
Someone should probably turn this into a nice how-to:
Here is how I did it.
wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz tar zxfv ssl.ca-0.1.tar.gz cd ssl.ca-0.1/ perl -i -pe 's/md5/sha1/g' *.sh perl -i -pe 's/2048/2048/g' *.sh This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/ ./new-root-ca.sh ./new-server-cert.sh self.bkw.org <http://self.bkw.org> ./sign-server-cert.sh self.bkw.org <http://self.bkw.org> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem
Setup Apache:
default-ssl:
SSLCertificateFile /usr/local/freeswitch/certs/wss.pem SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem
Setup Sofia TLS:
cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/agent.pem cat ca.crt > /usr/local/freeswitch/certs/cafile.pem
vars.xml:
<X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
Restart FreeSWITCH.
Now make sure your system has ca.crt imported so it will trust your new found hotness.
TEST:
openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082>
Depending on what you've setup you'll see:
subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web Server/CN=self.bkw.org/emailAddress=brian@bkw.org <http://self.bkw.org/emailAddress=brian@bkw.org>
issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang Bang/OU=Certification Services Division/CN=WBB Root CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org>
Or there abouts.
--
*/Brian West/* brian@freeswitch.org <mailto:brian@freeswitch.org>
*/Twitter: @FreeSWITCH , @briankwest/* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
More than a script, it would be better if you post minimum cert requirements to let the FS work Luis Daniel Lucio Quiroz CISSP, CISM, CISA Linux, VoIP and much more fun www.okay.com.mx Need LCR? Check out LCR for FusionPBX with FreeSWITCH Need Billing? Check out Billing for FusionPBX with FreeSWITCH 2015-06-30 23:52 GMT-04:00 Nandy Dagondon <nandy1925@gmail.com>:
Hi Brian,
I used your script to generate the certificates to test mod_verto in an intranet setup. Questions on your script:
1) Is 4096 bits required? Or 2048 bits will work, too? 2) Examining certs/wss.pem, there should be a <chain> certificate at the end. But the script, inputs only 2 - *.crt and *.key. What should be the 3rd?
Tks, /Nandy
On Sat, Jul 26, 2014 at 2:59 AM, Brian West <brian@freeswitch.org> wrote:
I've corrected the how-to and put it in tree:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to...
Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out. If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE.
On Fri, Jul 25, 2014 at 1:53 PM, William King < william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work with the custom CA?
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 07/25/2014 08:12 AM, Brian West wrote:
Someone should probably turn this into a nice how-to:
Here is how I did it.
wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz tar zxfv ssl.ca-0.1.tar.gz cd ssl.ca-0.1/ perl -i -pe 's/md5/sha1/g' *.sh perl -i -pe 's/2048/2048/g' *.sh This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/ ./new-root-ca.sh ./new-server-cert.sh self.bkw.org <http://self.bkw.org> ./sign-server-cert.sh self.bkw.org <http://self.bkw.org> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem
Setup Apache:
default-ssl:
SSLCertificateFile /usr/local/freeswitch/certs/wss.pem SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem
Setup Sofia TLS:
cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/agent.pem cat ca.crt > /usr/local/freeswitch/certs/cafile.pem
vars.xml:
<X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
Restart FreeSWITCH.
Now make sure your system has ca.crt imported so it will trust your new found hotness.
TEST:
openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082>
Depending on what you've setup you'll see:
subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web Server/CN=self.bkw.org/emailAddress=brian@bkw.org <http://self.bkw.org/emailAddress=brian@bkw.org>
issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang Bang/OU=Certification Services Division/CN=WBB Root CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org>
Or there abouts.
--
*/Brian West/* brian@freeswitch.org <mailto:brian@freeswitch.org>
*/Twitter: @FreeSWITCH , @briankwest/* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Luis, I'm aware of that. I've digged into SSL/TLS certificates (just self-signed for my intranet setup) and WebRTC - one by one. Now, all ports are listening for mod_verto 8081, 8082 and 7443. However, FS log shows this error messages like: 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:3209 192.168.10.80:41210 Client Connect. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1379 192.168.10.80:41210 Starting client thread. 2014-08-05 16:44:11.831823 [DEBUG] mod_verto.c:1292 192.168.10.80:41210 WS SETUP FAILED 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1405 192.168.10.80:41210 Ending client thread. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1412 192.168.10.80:41210 Thread ended Upon testing with openssl s_client, port 443 returned Verify code: 19 (self signed certificate in certificate chain). But in port 7443, it's code: 21 (unable to verify the first certificate). I encountered this same error code in port 443 before. Solution: added self-signed CA certificate in my web server configuration. I think I can zero in the solution - how to add the CA certificate to certs/wss.pem? Or ... the secure-chain parameter in verto.conf.xml, should point to the CA certificate file? <param name="secure-combined" value= "/usr/local/freeswitch/certs/wss.pem"/> <param name="secure-chain" value="/usr/local/freeswitch/certs/wss.pem" /> Any input? Tks, /Nandy On Wed, Jul 1, 2015 at 10:13 PM, Luis Daniel Lucio Quiroz < luis.daniel.lucio@gmail.com> wrote:
More than a script, it would be better if you post minimum cert requirements to let the FS work
Luis Daniel Lucio Quiroz CISSP, CISM, CISA Linux, VoIP and much more fun www.okay.com.mx
Need LCR? Check out LCR for FusionPBX with FreeSWITCH Need Billing? Check out Billing for FusionPBX with FreeSWITCH
2015-06-30 23:52 GMT-04:00 Nandy Dagondon <nandy1925@gmail.com>:
Hi Brian,
I used your script to generate the certificates to test mod_verto in an intranet setup. Questions on your script:
1) Is 4096 bits required? Or 2048 bits will work, too? 2) Examining certs/wss.pem, there should be a <chain> certificate at the end. But the script, inputs only 2 - *.crt and *.key. What should be the 3rd?
Tks, /Nandy
On Sat, Jul 26, 2014 at 2:59 AM, Brian West <brian@freeswitch.org> wrote:
I've corrected the how-to and put it in tree:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to...
Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out. If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE.
On Fri, Jul 25, 2014 at 1:53 PM, William King < william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work with the custom CA?
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 07/25/2014 08:12 AM, Brian West wrote:
Someone should probably turn this into a nice how-to:
Here is how I did it.
wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz tar zxfv ssl.ca-0.1.tar.gz cd ssl.ca-0.1/ perl -i -pe 's/md5/sha1/g' *.sh perl -i -pe 's/2048/2048/g' *.sh This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/ ./new-root-ca.sh ./new-server-cert.sh self.bkw.org <http://self.bkw.org> ./sign-server-cert.sh self.bkw.org <http://self.bkw.org> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem
Setup Apache:
default-ssl:
SSLCertificateFile /usr/local/freeswitch/certs/wss.pem SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem
Setup Sofia TLS:
cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/agent.pem cat ca.crt > /usr/local/freeswitch/certs/cafile.pem
vars.xml:
<X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
Restart FreeSWITCH.
Now make sure your system has ca.crt imported so it will trust your new found hotness.
TEST:
openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> openssl s_client -connect self.bkw.org:8082 <http://self.bkw.org:8082
Depending on what you've setup you'll see:
subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web Server/CN=self.bkw.org/emailAddress=brian@bkw.org <http://self.bkw.org/emailAddress=brian@bkw.org>
issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang Bang/OU=Certification Services Division/CN=WBB Root CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org>
Or there abouts.
--
*/Brian West/* brian@freeswitch.org <mailto:brian@freeswitch.org>
*/Twitter: @FreeSWITCH , @briankwest/* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Tried to point "secure-chain" parameter to (self-signed) CAcert.pem. The same error code returned 21 (unable to verify ... ). On Thu, Jul 2, 2015 at 10:47 AM, Nandy Dagondon <nandy1925@gmail.com> wrote:
Hi Luis,
I'm aware of that. I've digged into SSL/TLS certificates (just self-signed for my intranet setup) and WebRTC - one by one. Now, all ports are listening for mod_verto 8081, 8082 and 7443. However, FS log shows this error messages like:
2014-08-05 16:44:11.831823 [INFO] mod_verto.c:3209 192.168.10.80:41210 Client Connect. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1379 192.168.10.80:41210 Starting client thread. 2014-08-05 16:44:11.831823 [DEBUG] mod_verto.c:1292 192.168.10.80:41210 WS SETUP FAILED 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1405 192.168.10.80:41210 Ending client thread. 2014-08-05 16:44:11.831823 [INFO] mod_verto.c:1412 192.168.10.80:41210 Thread ended
Upon testing with openssl s_client, port 443 returned Verify code: 19 (self signed certificate in certificate chain). But in port 7443, it's code: 21 (unable to verify the first certificate). I encountered this same error code in port 443 before. Solution: added self-signed CA certificate in my web server configuration.
I think I can zero in the solution - how to add the CA certificate to certs/wss.pem?
Or ... the secure-chain parameter in verto.conf.xml, should point to the CA certificate file? <param name="secure-combined" value= "/usr/local/freeswitch/certs/wss.pem"/> <param name="secure-chain" value= "/usr/local/freeswitch/certs/wss.pem"/>
Any input?
Tks, /Nandy
On Wed, Jul 1, 2015 at 10:13 PM, Luis Daniel Lucio Quiroz < luis.daniel.lucio@gmail.com> wrote:
More than a script, it would be better if you post minimum cert requirements to let the FS work
Luis Daniel Lucio Quiroz CISSP, CISM, CISA Linux, VoIP and much more fun www.okay.com.mx
Need LCR? Check out LCR for FusionPBX with FreeSWITCH Need Billing? Check out Billing for FusionPBX with FreeSWITCH
2015-06-30 23:52 GMT-04:00 Nandy Dagondon <nandy1925@gmail.com>:
Hi Brian,
I used your script to generate the certificates to test mod_verto in an intranet setup. Questions on your script:
1) Is 4096 bits required? Or 2048 bits will work, too? 2) Examining certs/wss.pem, there should be a <chain> certificate at the end. But the script, inputs only 2 - *.crt and *.key. What should be the 3rd?
Tks, /Nandy
On Sat, Jul 26, 2014 at 2:59 AM, Brian West <brian@freeswitch.org> wrote:
I've corrected the how-to and put it in tree:
https://stash.freeswitch.org/projects/FS/repos/freeswitch/browse/docs/how_to...
Importing the ca.crt into your system keychain for it to be trusted is left to the end user to figure out. If you can't do that step then you'll kinda be SOL, I know on my Mac I just open ca.crt and it does the import for me... Windows I suspect is similar as for Linux NO CLUE.
On Fri, Jul 25, 2014 at 1:53 PM, William King < william.king@quentustech.com> wrote:
One correction inline, and did you have any luck getting chrome to work with the custom CA?
William King Senior Engineer Quentus Technologies, INC 1037 NE 65th St Suite 273 Seattle, WA 98115 Main: (877) 211-9337 Office: (206) 388-4772 Cell: (253) 686-5518 william.king@quentustech.com
On 07/25/2014 08:12 AM, Brian West wrote:
Someone should probably turn this into a nice how-to:
Here is how I did it.
wget http://www.openssl.org/contrib/ssl.ca-0.1.tar.gz tar zxfv ssl.ca-0.1.tar.gz cd ssl.ca-0.1/ perl -i -pe 's/md5/sha1/g' *.sh perl -i -pe 's/2048/2048/g' *.sh This is a noop. I assume it was suppose to be /2048/4096/ or /1024/2048/ ./new-root-ca.sh ./new-server-cert.sh self.bkw.org <http://self.bkw.org> ./sign-server-cert.sh self.bkw.org <http://self.bkw.org> cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/wss.pem
Setup Apache:
default-ssl:
SSLCertificateFile /usr/local/freeswitch/certs/wss.pem SSLCertificateKeyFile /usr/local/freeswitch/certs/wss.pem SSLCertificateChainFile /usr/local/freeswitch/certs/wss.pem
Setup Sofia TLS:
cat self.bkw.org.crt self.bkw.org.key > /usr/local/freeswitch/certs/agent.pem cat ca.crt > /usr/local/freeswitch/certs/cafile.pem
vars.xml:
<X-PRE-PROCESScmd="set"data="internal_ssl_enable=true"/> <X-PRE-PROCESScmd="set"data="external_ssl_enable=true"/>
Restart FreeSWITCH.
Now make sure your system has ca.crt imported so it will trust your new found hotness.
TEST:
openssl s_client -connect self.bkw.org:443 <http://self.bkw.org:443> openssl s_client -connect self.bkw.org:8082 < http://self.bkw.org:8082>
Depending on what you've setup you'll see:
subject=/C=US/ST=Oklahoma/L=McAlester/O=Tonka Truck/OU=Secure Web Server/CN=self.bkw.org/emailAddress=brian@bkw.org <http://self.bkw.org/emailAddress=brian@bkw.org>
issuer=/C=US/ST=Oklahoma/L=McAlester/O=Whizzzzzzy Bang Bang/OU=Certification Services Division/CN=WBB Root CA/emailAddress=brian@bkw.org <mailto:brian@bkw.org>
Or there abouts.
--
*/Brian West/* brian@freeswitch.org <mailto:brian@freeswitch.org>
*/Twitter: @FreeSWITCH , @briankwest/* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
--
*Brian West* brian@freeswitch.org
*Twitter: @FreeSWITCH , @briankwest* http://www.freeswitchbook.com http://www.freeswitchcookbook.com
*T:*+19184209001 | *F:*+19184209002 | *M:*+1918424WEST (9378) *iNUM:*+883 5100 1420 9001 | *ISN:*410*543 | *Skype:*briankwest
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (5)
-
Brian West
-
François Delawarde
-
Luis Daniel Lucio Quiroz
-
Nandy Dagondon
-
William King