SSL/TLS customized encryption.
Hi all, I am trying to create certificates and keys on a customized encryption scheme. AFAIK gentls_cert generates certificates and keys with : Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit) I want the encryption to be according the SUITE-B standard ,i .e 1. (AES) with key sizes of 128 and 256 bits 2 . Elliptic Curve Digital Signature Algorithm 3 . Elliptic Curve Diffie–Hellman (ECDH) — key agreement 4 .Secure Hash Algorithm 2 (SHA-256 and SHA-384) — message digest I can see FS script (gentls_cert) is using openssl at the back. And as i have very little idea of encryption and all using openssl , i need to know if this is possible to mend this script to our requirements, if so ... how and where should i look at first! Thanks -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-TLS-customized-encryption-... Sent from the freeswitch-users mailing list archive at Nabble.com.
Any Volunteer? :) -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-TLS-customized-encryption-... Sent from the freeswitch-users mailing list archive at Nabble.com.
Well, create the certificates according to your needs and go for it. "Mending" the scripts to your needs is as easy as modifying a shell script which gentls is. Fs uses openssl lib link so it should work with every negotiated encryption scheme. On Mar 28, 2013 2:14 PM, "mehroz" <mehroz.ashraf85@gmail.com> wrote:
Any Volunteer? :)
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-TLS-customized-encryption-... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks Daniel Ivanov. I believe, this is more related to knowing openssl library and the use of it. I am trying to get it learned to acquire the desired results. Looking up for some more feedback and ideas ! Thanks Eveyone -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-TLS-customized-encryption-... Sent from the freeswitch-users mailing list archive at Nabble.com.
You don't need to know the library by heart to use it. This is kinda the idea of code linking. Use the openssl wrapper to create your certificate chains and just plug em in freeswitch tls . On Mar 29, 2013 7:48 AM, "mehroz" <mehroz.ashraf85@gmail.com> wrote:
Thanks Daniel Ivanov.
I believe, this is more related to knowing openssl library and the use of it. I am trying to get it learned to acquire the desired results.
Looking up for some more feedback and ideas ! Thanks Eveyone
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-TLS-customized-encryption-... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Tried to change gentls_cert script where openssl creates keys and certificates , with Elliptic curve parameters, but it always generates error with the command. Is there any way around other than that. How can we generate certs/keys without using FS script? It might help too see what is really happening ! -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-TLS-customized-encryption-... Sent from the freeswitch-users mailing list archive at Nabble.com.
HI all, As far i have learnt, openssl should support the required encryption model. lets say, now i have got the version of openSSL meeting the standards. I want to restrict SIP/TLS cipher to support only the said encryption. Question: where do i have to mention , to use only that specific cipher model . (like, if its HTTPS, i would mention it somewhere in apache settings or nginx settings). Does FS support it or ill have to play directly with openssl? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/SSL-TLS-customized-encryption-... Sent from the freeswitch-users mailing list archive at Nabble.com.
participants (2)
-
Daniel Ivanov
-
mehroz