<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
<br>hi all,<br>no one know this error ?<br>or no one can help me ?<br>please suggest if any one know this problem ! <br><hr id="stopSpelling"> From: betergreen@live.com<br>To: sr-users@lists.sip-router.org<br>Date: Sat, 4 Sep 2010 12:21:23 +0700<br>Subject: [SR-Users] please help to register sip phone to kamailio server via tls support.<br><br>
<meta http-equiv="Content-Type" content="text/html; charset=unicode">
<meta name="Generator" content="Microsoft SafeHTML">
<style>
.ExternalClass .ecxhmmessage P
{padding:0px;}
.ExternalClass body.ecxhmmessage
{font-size:10pt;font-family:Tahoma;}
</style>
hi all,<br>I have configured tls support in kamailio, but i cannot register sip phone.<br><br>my configure :<br><br>I create cert and private key as:<br><br><span class="ecxquote">"kamctl tls userCERT user"<br><br>log show :<br><br>Creating directory /usr/local/etc/kamailio//tls/user<br>Creating user certificate request<br>Generating a 512 bit RSA private key<br>..++++++++++++<br>...................++++++++++++<br>writing new private key to '/usr/local/etc/kamailio//tls/user/user-privkey.pem'<br>-----<br>Signing certificate request<br>Using configuration from /usr/local/etc/kamailio//tls/request.conf<br>Enter pass phrase for ./rootCA/private/cakey.pem:<br>Check that the request matches the signature<br>Signature ok<br>The Subject's Distinguished Name is as follows<br>commonName :PRINTABLE:'somename.somewhere.com'<br>stateOrProvinceName :PRINTABLE:'Some State'<br>countryName :PRINTABLE:'XY'<br>emailAddress :IA5STRING:'root@somename.somewhere.com'<br>organizationName :PRINTABLE:'My Large Organization Name'<br>organizationalUnitName:PRINTABLE:'My Subunit of Large Organization'<br>Certificate is to be certified until Sep 4 09:13:58 2011 GMT (365 days)<br>Sign the certificate? [y/n]:y<br><br><br>1 out of 1 certificate requests certified, commit? [y/n]y<br>Write out database with 1 new entries<br>Data Base Updated<br>Generating CA list<br>DONE<br>INFO: Private key is locate at /usr/local/etc/kamailio//tls/user/user-privkey.pem<br>INFO: Certificate is locate at /usr/local/etc/kamailio//tls/user/user-cert.pem<br>INFO: CA-List is locate at /usr/local/etc/kamailio//tls/user/user-calist.pem<br><br><br>I add to kamailio.cfg<br><br>enable_tls=1<br>tcp_async=no<br><br>modparam("tls", "tls_method", "TLSv1")<br>modparam("tls", "certificate", "/usr/local/etc/kamailio//tls/user/user-cert.pem")<br>modparam("tls", "private_key", "/usr/local/etc/kamailio//tls/user/user-privkey.pem")<br>modparam("tls", "ca_list", "/usr/local/etc/kamailio//tls/user/user-calist.pem")<br>modparam("tls", "verify_certificate", 1)<br>modparam("tls", "require_certificate", 1)<br><br>i restart kamailio:<br><br>"kamctl restart"<br><br>log in tail -f /var/log/message<br><br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:175]: TLSc<default>: tls_method=9<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:185]: TLSc<default>: certificate='/usr/local/etc/kamailio//tls/user/user-cert.pem'<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:190]: TLSc<default>: ca_list='/usr/local/etc/kamailio//tls/user/user-calist.pem'<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:193]: TLSc<default>: require_certificate=1<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:198]: TLSc<default>: cipher_list='(null)'<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:203]: TLSc<default>: private_key='/usr/local/etc/kamailio//tls/user/user-privkey.pem'<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:206]: TLSc<default>: verify_certificate=1<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:209]: TLSc<default>: verify_depth=9<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:331]: TLSc<default>: Server MUST present valid certificate<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: WARNING: tls [tls_domain.c:395]: tls: set_ssl_options: openssl SSL_OP_TLS_BLOCK_PADDING bug workaround enabled (openssl version 90802f)<br>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3116]: INFO: ctl [io_listener.c:224]: io_listen_loop: using epoll_lt io watch method (config)<br><br><br>i see that kamailio start okie, but sip phone cannot register.<br><br>log in :tail -f /var/log/message:<br><br>Sep 4 05:18:50 appliance /usr/local/sbin/kamailio[3117]: ERROR: tls [tls_server.c:392]: SSL error:error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca<br><br>in portgo : certificate validation failure.<br><br>please suggest to fix it,<br>thanks.<br>Peter green<br><br><br><br></span>
<br>_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users@lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users </body>
</html>