I have already installed the CA certificate in the FS conf/ssl (following FS/TLS wiki) and managed to get TLS registering with PhonerLite so I know that basically it should work with other sip/tls clients as well.I'm trying to setup other softphones with TLS/SIPS connection to Freeswitch and I'm failing to register with CSimpleSip/android and Jitsi/windows. I get this:tport_type_tls.c:607 tport_tls_accept() tport_tls_accept(0xb6e02268): new connection from tls/1.2.3.4:13886/sipstport_tls.c:873 tls_connect() tls_connect(0xb6e02268): events NEGOTIATINGtport_tls.c:873 tls_connect() tls_connect(0xb6e02268): events NEGOTIATINGtport_tls.c:962 tls_connect() tls_connect(0xb6e02268): TLS setup failed (error:00000001:lib(0):func(0):reason(1))tport.c:2092 tport_close() tport_close(0xb6e02268): tls/1.2.3.4:13886/sipsI will appriciate any help/instruction/tip on how to setup working TLS connection with CSimpleSip/android and Jitsi/windows clients.Thanks -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Client-TLS-certificate-setup-t... Sent from the freeswitch-users mailing list archive at Nabble.com.
What kind of certificate are you using? Self -signed, chained with intermediate or root-verified? On May 3, 2013 12:30 AM, "adahary" <adahary@gmail.com> wrote:
I have already installed the CA certificate in the FS conf/ssl (following
FS/TLS wiki) and managed to get TLS registering with PhonerLite so I know that basically it should work with other sip/tls clients as well. I'm trying to setup other softphones with TLS/SIPS connection to Freeswitch and I'm failing to register with CSimpleSip/android and Jitsi/windows. I get this: tport_type_tls.c:607 tport_tls_accept() tport_tls_accept(0xb6e02268): new connection from tls/1.2.3.4:13886/sips tport_tls.c:873 tls_connect() tls_connect(0xb6e02268): events NEGOTIATING tport_tls.c:873 tls_connect() tls_connect(0xb6e02268): events NEGOTIATING tport_tls.c:962 tls_connect() tls_connect(0xb6e02268): TLS setup failed (error:00000001:lib(0):func(0):reason(1)) tport.c:2092 tport_close() tport_close(0xb6e02268): tls/1.2.3.4:13886/sips I will appriciate any help/instruction/tip on how to setup working TLS connection with CSimpleSip/android and Jitsi/windows clients. Thanks
________________________________ View this message in context: Client TLS certificate setup Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I've followed:http://wiki.freeswitch.org/wiki/SIP_TLSagent.pem => ./gentls_cert setup -cn pbx.freeswitch.org -alt DNS:pbx.freeswitch.org -org freeswitch.org.cafile.pem => ./gentls_cert create_server -cn pbx.freeswitch.org -alt DNS:pbx.freeswitch.org -org freeswitch.org.client.pem => ./gentls_cert create_client ...also generated pkcs12 which was installed successfuly is both jitsi and csimplesip (but fail to register):openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crtThis is the TLS part of vars.xml: The reload mod_sofia log shows that it is loading the .pem files from the conf/ssl.any tls registration tls/1.2.3.4/sips from jitsi/csimplesip get rejected with certificate error.thanks for your support -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Client-TLS-certificate-setup-t... Sent from the freeswitch-users mailing list archive at Nabble.com.
Daniel,Now I see that I get the 'err 26:unsupported certificate purpose' for the fail reason.I have checked the purpose and found 'TLS Web..' - should be ok.What could be the reason?fs_client log:tport.c:2745 tport_wakeup_pri() tport_wakeup_pri(0x9a97ea0): events INtport.c:869 tport_alloc_secondary() tport_alloc_secondary(0x9a97ea0): new secondary tport 0x9b03ea0tport_type_tls.c:607 tport_tls_accept() tport_tls_accept(0x9b03ea0): new connection from tls/62.90.161.235:50438/sipstport_tls.c:873 tls_connect() tls_connect(0x9b03ea0): events NEGOTIATINGtport_tls.c:873 tls_connect() tls_connect(0x9b03ea0): events NEGOTIATINGtport_tls.c:253 tls_verify_cb() -Error with certificate at depth: 0tport_tls.c:255 tls_verify_cb() issuer = /CN=il1.mobi2save.com/O=mobi2save.comtport_tls.c:257 tls_verify_cb() subject = /CN=il1.mobi2save.com/O=mobi2save.comtport_tls.c:258 tls_verify_cb() *err 26:unsupported certificate purpose*tport_tls.c:962 tls_connect() tls_connect(0x9b03ea0): TLS setup failed (error:00000001:lib(0):func(0):reason(1))tport.c:2092 tport_close() tport_close(0x9b03ea0): tls/62.90.161.235:50438/sipsfreeswitch@127.0.0.1:8028@internal>[root@il1 ssl]# openssl x509 -in client.pem -text -nooutCertificate: Data: Version: 3 (0x2) Serial Number: b2:68:02:6b:19:d3:aa:36 Signature Algorithm: sha1WithRSAEncryption Issuer: CN=il1.mobi2save.com, O=mobi2save.com Validity Not Before: May 2 19:20:09 2013 GMT Not After : May 1 19:20:09 2019 GMT Subject: CN=il1.mobi2save.com, O=mobi2save.com Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:cf:81:c9:62:5a:0b:d0:0e:2e:5b:7b:21:bf:9e: b9:50:3a:bc:91:5b:93:21:8c:87:8d:f2:1b:df:24: 19:7a:4a:0d:e3:39:00:7f:a8:5d:d3:8f:c6:67:90: 60:cb:53:ee:c9:74:b0:74:d9:fe:90:7d:15:bf:82: 3d:89:cb:49:6a:54:96:65:72:01:d8:12:a8:23:63: 85:bd:a6:e4:c6:12:86:45:d3:8f:c2:ea:58:34:b5: 0e:a5:89:b5:fe:d6:8f:f3:9e:cb:2b:cc:5e:f3:b1: ff:30:d2:b6:8f:c0:af:70:a7:bc:2c:c6:1d:79:3a: bc:87:07:5e:70:ca:d9:9c:c7:91:d5:25:47:92:62: 55:47:df:c6:0b:38:55:a5:c1:d1:e3:98:47:5f:be: 90:84:05:41:6f:84:1e:4c:7b:0d:d4:21:6f:20:12: f5:d9:73:0e:bf:0c:31:df:86:40:86:56:91:f5:dc: 6d:30:32:8b:b1:9c:09:82:b7:f4:ec:18:1e:7b:9f: 41:a1:49:84:3f:01:a9:ea:d5:0b:37:81:a5:3c:58: af:31:92:b4:db:53:9f:6b:05:08:7b:34:d1:62:9f: 23:54:4a:c2:2b:eb:c0:9a:c3:9d:da:ae:72:19:24: 1c:5f:62:68:01:b9:0f:5e:9e:04:7a:5b:6d:ce:06: 03:c1 Exponent: 65537 (0x10001) X509v3 extensions: Netscape Comment: FS Client Cert X509v3 Basic Constraints: CA:FALSE X509v3 Subject Key Identifier: 33:41:5C:37:CF:8B:B3:C6:45:72:28:81:6A:97:FB:7D:D4:EF:41:AE X509v3 Authority Key Identifier: DirName:/CN=il1.mobi2save.com/O=mobi2save.com serial:B4:B8:71:80:AC:28:33:48 X509v3 Subject Alternative Name: DNS:il1.mobi2save.com Netscape Cert Type: SSL Client X509v3 Extended Key Usage: TLS Web Client Authentication Signature Algorithm: sha1WithRSAEncryption 5f:46:da:81:89:6f:2e:60:9f:f8:fb:8c:a9:87:d1:53:7f:78: b4:0c:98:ab:fc:93:53:41:4f:24:24:71:02:1e:59:92:ca:08: 47:f4:3f:2f:da:3f:f0:d8:4c:5b:69:24:d1:29:f7:9d:d7:95: 0d:a0:25:5d:4a:6e:04:69:c4:4e:58:77:ba:24:11:59:14:7d: 23:4c:e3:c3:27:df:8e:cc:c0:30:1e:29:c3:94:c3:a6:05:23: 76:60:0a:aa:6e:7d:a0:fc:12:c8:49:96:41:b9:1f:3c:8c:d8: 8a:fa:a3:14:5b:11:67:26:6d:85:57:2d:10:86:fa:65:62:12: e9:8b:6a:a8:2b:dc:0c:70:3e:3d:f6:2d:97:9a:82:41:5f:99: fe:67:f7:7c:f3:48:4e:2a:2d:d0:32:46:77:a4:00:05:3d:be: 26:4d:d9:92:9b:92:8e:78:ac:01:5b:a0:29:fa:9c:69:c1:74: 86:26:ce:e3:fa:b3:40:b5:59:bb:b3:fe:27:91:4a:4f:2b:89: 0e:bd:e6:7a:ca:28:8f:64:31:71:5b:77:4d:65:2a:77:30:7d: 69:21:0c:54:77:6e:2e:8c:d2:72:35:ad:8f:e7:f0:04:34:cb: da:25:40:ec:14:9b:34:dd:60:ad:0a:39:d9:df:91:11:66:9c: 03:ee:4a:d7 -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Client-TLS-certificate-setup-t... Sent from the freeswitch-users mailing list archive at Nabble.com.
hi ,all please use below mentioned cert file code in your gencert-tls file , hope Tls connection made successfully iffi ::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: #!/bin/sh CONFDIR=/usr/local/freeswitch/conf/ssl DAYS=2190 KEY_SIZE=1024 export KEY_SIZE=${KEY_SIZE} TMPFILE="/tmp/fs-ca-$$-$(date +%Y%m%d%H%M%S)" COMMON_NAME="FreesSWITCH CA" ALT_NAME="DNS:test.freeswitch.org" ORG_NAME="FreeSWITCH" OUTFILE="agent.pem" umask 037 check_ca() { for x in cacert.pem cakey.pem config.tpl; do if [ ! -e "${CONFDIR}/CA/${x}" ]; then return 1 fi done return 0 } setup_ca() { if check_ca; then echo "Existing CA found in \"${CONFDIR}/CA\"" echo "(Use \"gentls_cert remove\" to delete)" exit 1 fi echo "Creating new CA..." if [ ! -d "${CONFDIR}/CA" ]; then mkdir -p -m 750 "${CONFDIR}/CA" || exit 1 fi if [ -e "${CONFDIR}/CA/config.tpl" ]; then if [ $0 -nt "${CONFDIR}/CA/config.tpl" ]; then echo "WARNING! genttls_cert has a modified time more recent than ${CONFDIR}/CA/config.tpl remove config.tpl to re-generate it" fi else cat > "${CONFDIR}/CA/config.tpl" <<-EOF [ req ] default_bits = \$ENV::KEY_SIZE prompt = no distinguished_name = req_dn [ req_dn ] commonName = %CN% organizationName = %ORG% [ server ] nsComment="FS Server Cert" basicConstraints=CA:FALSE subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer:always subjectAltName=%ALTNAME% nsCertType=server extendedKeyUsage=serverAuth [ client ] nsComment="FS Client Cert" basicConstraints=CA:FALSE subjectKeyIdentifier=hash authorityKeyIdentifier=keyid,issuer:always subjectAltName=%ALTNAME% nsCertType=client extendedKeyUsage=clientAuth EOF fi sed \ -e "s|%CN%|$COMMON_NAME|" \ -e "s|%ORG%|$ORG_NAME|" \ -e "/%ALTNAME%/d" \ -e "s|CA:FALSE|CA:TRUE|" \ "${CONFDIR}/CA/config.tpl" \ > "${TMPFILE}.cfg" || exit 1 openssl req -out "${CONFDIR}/CA/cacert.pem" \ -new -x509 -keyout "${CONFDIR}/CA/cakey.pem" \ -config "${TMPFILE}.cfg" -nodes -days ${DAYS} -sha1 >/dev/null || exit 1 cat "${CONFDIR}/CA/cacert.pem" > "${CONFDIR}/cafile.pem" rm "${TMPFILE}.cfg" echo "DONE" } generate_cert() { local val="" if ! check_ca; then echo "No existing CA found, please create one with \"gentls_cert setup\" first" exit 1 fi echo "Generating new certificate..." echo echo "--------------------------------------------------------" echo "CN: \"${COMMON_NAME}\"" echo "ORG_NAME: \"${ORG_NAME}\"" echo "ALT_NAME: \"${ALT_NAME}\"" echo echo "Certificate filename \"${OUTFILE}\"" echo echo "[Is this OK? (y/N)]" read val if [ "${val}" != "y" ] && [ "${val}" != "Y" ]; then echo "Aborted" return 2 fi sed \ -e "s|%CN%|$COMMON_NAME|" \ -e "s|%ALTNAME%|$ALT_NAME|" \ -e "s|%ORG%|$ORG_NAME|" \ "${CONFDIR}/CA/config.tpl" \ > "${TMPFILE}.cfg" || exit 1 openssl req -new -out "${TMPFILE}.req" \ -newkey rsa:${KEY_SIZE} -keyout "${TMPFILE}.key" \ -config "${TMPFILE}.cfg" -nodes -sha1 >/dev/null || exit 1 openssl x509 -req -CAkey "${CONFDIR}/CA/cakey.pem" -CA "${CONFDIR}/CA/cacert.pem" -CAcreateserial \ -in "${TMPFILE}.req" -out "${TMPFILE}.crt" -extfile "${TMPFILE}.cfg" \ -extensions "${EXTENSIONS}" -days ${DAYS} -sha1 >/dev/null || exit 1 cat "${TMPFILE}.crt" "${TMPFILE}.key" > "${CONFDIR}/${OUTFILE}" rm "${TMPFILE}.cfg" "${TMPFILE}.crt" "${TMPFILE}.key" "${TMPFILE}.req" echo "DONE" } remove_ca() { echo "Removing CA" if [ -d "${CONFDIR}/CA" ]; then rm "${CONFDIR}/CA/"* rmdir "${CONFDIR}/CA" fi echo "DONE" } OUTFILESET="0" command="$1" shift while [ $# -gt 0 ]; do case $1 in -cn) shift COMMON_NAME="$1" ;; -alt) shift ALT_NAME="$1" ;; -org) shift ORG_NAME="$1" ;; -out) shift OUTFILE="$1" OUTFILESET="1" ;; -days) shift DAYS="$1" ;; esac shift done case ${command} in setup) setup_ca ;; create) EXTENSIONS="server" generate_cert ;; create_server) EXTENSIONS="server" generate_cert ;; create_client) EXTENSIONS="client" if [ "${OUTFILESET}" = "0" ]; then OUTFILE="client.pem" fi generate_cert ;; remove) echo "Are you sure you want to delete the CA? [YES to delete]" read val if [ "${val}" = "YES" ]; then remove_ca else echo "Not deleting CA" fi ;; *) cat <<-EOF $0 <setup|create_server|create_client|clean> [options] * commands: setup - Setup new CA remove - Remove CA create_server - Create new certificate (overwriting existing!) create_client - Create a new client certificate (overwrites existing!) * options: -cn Set common name -alt Set alternative name (use prefix 'DNS:' or 'URI:') -org Set organization name -out Filename for new certificate (create only) -days Certificate expires in X days (default: 365) EOF exit 1 ;; esac -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Client-TLS-certificate-setup-t... Sent from the freeswitch-users mailing list archive at Nabble.com.
participants (3)
-
Abdullah
-
adahary
-
Daniel Ivanov