Its probably going to be the cipher suite, how did you generate the certificate? -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Sep 14, 2013, at 1:35 PM, Dror Lupu <drorlupu@gmail.com> wrote:

Hi Guys,

I’ve done the steps for TLS setup as shown on the Wiki (using the server’s IP address in CN and ALT), but I can’t get TLS to work (UDP/TCP works fine). All certificates seem to be in place and generated correctly. I get this error, when using Linphone (I installed the root CA on my machine). 1. tport.c:2745 tport_wakeup_pri() tport_wakeup_pri(0xb5062a60): events IN 2. tport.c:869 tport_alloc_secondary() tport_alloc_secondary(0xb5062a60): new secondary tport 0xb67c0410 3. tport_type_tls.c:607 tport_tls_accept() tport_tls_accept(0xb67c0410): new connection from tls/172.16.111.211:61942/sips 4. tport_tls.c:873 tls_connect() tls_connect(0xb67c0410): events NEGOTIATING 5. tport_tls.c:873 tls_connect() tls_connect(0xb67c0410): events NEGOTIATING 6. tport_tls.c:962 tls_connect() tls_connect(0xb67c0410): TLS setup failed (error:00000001:lib(0):func(0):reason(1)) 7. tport.c:2092 tport_close() tport_close(0xb67c0410): tls/172.16.111.211:61942/sips 8. Any ideas?

Thanks in advance,

hi ,all please use below mentioned cert file code in your gencert-tls file , hope Tls connection made successfully iffi ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: #!/bin/sh CONFDIR=/usr/local/freeswitch/conf/ssl DAYS=2190 KEY_SIZE=1024 export KEY_SIZE=${KEY_SIZE} TMPFILE="/tmp/fs-ca-$$-$(date +%Y%m%d%H%M%S)" COMMON_NAME="FreesSWITCH CA" ALT_NAME="DNS:test.freeswitch.org" ORG_NAME="FreeSWITCH" OUTFILE="agent.pem" umask 037 check_ca() { for x in cacert.pem cakey.pem config.tpl; do if [ ! -e "${CONFDIR}/CA/${x}" ]; then return 1 fi done return 0 } setup_ca() { if check_ca; then echo "Existing CA found in \"${CONFDIR}/CA\"" echo "(Use \"gentls_cert remove\" to delete)" exit 1 fi echo "Creating new CA..." if [ ! -d "${CONFDIR}/CA" ]; then mkdir -p -m 750 "${CONFDIR}/CA" || exit 1 fi if [ -e "${CONFDIR}/CA/config.tpl" ]; then if [ $0 -nt "${CONFDIR}/CA/config.tpl" ]; then echo "WARNING! genttls_cert has a modified time more recent than ${CONFDIR}/CA/config.tpl remove config.tpl to re-generate it" fi else cat > "${CONFDIR}/CA/config.tpl" <<-EOF [ req ] default_bits = \$ENV::KEY_SIZE prompt = no distinguished_name = req_dn [ req_dn ] commonName = %CN% organizationName = %ORG% [ server ] nsComment="FS Server Cert" basicConstraints=CA:FALSE subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer:always subjectAltName=%ALTNAME% nsCertType=server extendedKeyUsage=serverAuth [ client ] nsComment="FS Client Cert" basicConstraints=CA:FALSE subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer:always subjectAltName=%ALTNAME% nsCertType=client extendedKeyUsage=clientAuth EOF fi sed \ -e "s|%CN%|$COMMON_NAME|" \ -e "s|%ORG%|$ORG_NAME|" \ -e "/%ALTNAME%/d" \ -e "s|CA:FALSE|CA:TRUE|" \ "${CONFDIR}/CA/config.tpl" \ > "${TMPFILE}.cfg" || exit 1 openssl req -out "${CONFDIR}/CA/cacert.pem" \ -new -x509 -keyout "${CONFDIR}/CA/cakey.pem" \ -config "${TMPFILE}.cfg" -nodes -days ${DAYS} -sha1 >/dev/null || exit 1 cat "${CONFDIR}/CA/cacert.pem" > "${CONFDIR}/cafile.pem" rm "${TMPFILE}.cfg" echo "DONE" } generate_cert() { local val="" if ! check_ca; then echo "No existing CA found, please create one with \"gentls_cert setup\" first" exit 1 fi echo "Generating new certificate..." echo echo "--------------------------------------------------------" echo "CN: \"${COMMON_NAME}\"" echo "ORG_NAME: \"${ORG_NAME}\"" echo "ALT_NAME: \"${ALT_NAME}\"" echo echo "Certificate filename \"${OUTFILE}\"" echo echo "[Is this OK? (y/N)]" read val if [ "${val}" != "y" ] && [ "${val}" != "Y" ]; then echo "Aborted" return 2 fi sed \ -e "s|%CN%|$COMMON_NAME|" \ -e "s|%ALTNAME%|$ALT_NAME|" \ -e "s|%ORG%|$ORG_NAME|" \ "${CONFDIR}/CA/config.tpl" \ > "${TMPFILE}.cfg" || exit 1 openssl req -new -out "${TMPFILE}.req" \ -newkey rsa:${KEY_SIZE} -keyout "${TMPFILE}.key" \ -config "${TMPFILE}.cfg" -nodes -sha1 >/dev/null || exit 1 openssl x509 -req -CAkey "${CONFDIR}/CA/cakey.pem" -CA "${CONFDIR}/CA/cacert.pem" -CAcreateserial \ -in "${TMPFILE}.req" -out "${TMPFILE}.crt" -extfile "${TMPFILE}.cfg" \ -extensions "${EXTENSIONS}" -days ${DAYS} -sha1 >/dev/null || exit 1 cat "${TMPFILE}.crt" "${TMPFILE}.key" > "${CONFDIR}/${OUTFILE}" rm "${TMPFILE}.cfg" "${TMPFILE}.crt" "${TMPFILE}.key" "${TMPFILE}.req" echo "DONE" } remove_ca() { echo "Removing CA" if [ -d "${CONFDIR}/CA" ]; then rm "${CONFDIR}/CA/"* rmdir "${CONFDIR}/CA" fi echo "DONE" } OUTFILESET="0" command="$1" shift while [ $# -gt 0 ]; do case $1 in -cn) shift COMMON_NAME="$1" ;; -alt) shift ALT_NAME="$1" ;; -org) shift ORG_NAME="$1" ;; -out) shift OUTFILE="$1" OUTFILESET="1" ;; -days) shift DAYS="$1" ;; esac shift done case ${command} in setup) setup_ca ;; create) EXTENSIONS="server" generate_cert ;; create_server) EXTENSIONS="server" generate_cert ;; create_client) EXTENSIONS="client" if [ "${OUTFILESET}" = "0" ]; then OUTFILE="client.pem" fi generate_cert ;; remove) echo "Are you sure you want to delete the CA? [YES to delete]" read val if [ "${val}" = "YES" ]; then remove_ca else echo "Not deleting CA" fi ;; *) cat <<-EOF $0 <setup|create_server|create_client|clean> [options] * commands: setup - Setup new CA remove - Remove CA create_server - Create new certificate (overwriting existing!) create_client - Create a new client certificate (overwrites existing!) * options: -cn Set common name -alt Set alternative name (use prefix 'DNS:' or 'URI:') -org Set organization name -out Filename for new certificate (create only) -days Certificate expires in X days (default: 365) EOF exit 1 ;; esac -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/TLS-problem-tp7594860p7596030.... Sent from the freeswitch-users mailing list archive at Nabble.com.