<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
<br><br>> Date: Mon, 13 Sep 2010 10:38:34 +0200<br>> From: klaus.mailinglists@pernau.at<br>> To: betergreen@live.com<br>> CC: sr-users@lists.sip-router.org<br>> Subject: Re: [SR-Users] help with tls error :sslv3 alert bad certificate<br>> <br>> Show us your complete TLS configuration<br>> <br>> regards<br>> Klaus<br>> Am 09.09.2010 20:06, schrieb peter_green lion:<br>> > SSL alert number 40<br><br>hi Klaus and all,<br>my configure as:<br><br>first i install kamailio with mysql, db mysql and tls.<br><br>i configure kamailio to use mysql database , it work ok. i add 2 sip account :101/101 , 102/102.<br><br>i follow document tls module :http://www.kamailio.org/docs/modules/3.0.x/modules/tls.html#tls.overview<br><br>i make cert as :<br><br><pre class="programlisting">Creating CA certificate
-----------------------
1. create CA dir
mkdir ca
cd ca
2. create ca dir structure and files (see ca(1))
mkdir demoCA #default CA name, edit /etc/ss/openssl.cnf
mkdir demoCA/private
mkdir demoCA/newcerts
touch demoCA/index.txt
echo 01 >demoCA/serial
2. create CA private key
openssl genrsa -out demoCA/private/cakey.pem 2048
chmod 600 demoCA/private/cakey.pem
3. create CA self-signed certificate
openssl req -out demoCA/cacert.pem -x509 -new -key demoCA/private/cakey.pem
Creating a server/client certificate
------------------------------------
1. create a certificate request (and its private key in privkey.pem)
openssl req -out ser1_cert_req.pem -new -nodes
WARNING: the organization name should be the same as in the ca certificate.
2. sign it with the ca certificate
openssl ca -in ser1_cert_req.pem -out ser1_cert.pem
3. copy ser1_cert.pem to your ser config. dir
Setting ser to use the certificate
----------------------------------
1. create the ca list file:
for each of your ca certificates that you intend to use do:
cat cacert.pem >>calist.pem
2. copy your ser certificate, private key and ca list file to your
intended machine (preferably in your ser cfg. directory, this is the
default place ser searches for)
3. set up ser.cfg to use the certificate
if your ser certificate name is different from cert.pem or it is not
placed in ser cfg. directory, add to your ser.cfg:
modparam("tls", "certificate", "/path/cert_file_name")
4. set up ser to use the private key
if your private key is not contained in the certificate (or the
certificate name is not the default cert.pem), add to your ser.cfg:
modparam("tls", "private_key", "/path/private_key_file")
5. set up ser to use the ca list (optional)
add to your ser.cfg:
modparam("tls", "ca_list", "/path/ca_list_file")
6. set up tls authentication options:
modparam("tls", "verify_certificate", 1)
modparam("tls", "require_certificate", 1)
(for more information see the module parameters documentation)<br><br>as follow your link :http://www.kamailio.org/dokuwiki/doku.php/tls:create-certificates<br></pre>i copy ser1_cert.pem, privkey.pem, cacert.pem to /usr/local/etc/kamailio<br>i transfer cacert.pem to another pc to add to sip certificate. <br>i add some line in kamailio.cfg as bellow:<br><br>enable_tls=1
<br>
tcp_async=no
<br><br>listen=tls:192.168.1.81:5060
<br><br>modparam("tls", "tls_method", "TLSv1")
<br>modparam("tls", "tls_method", "SSLv23")
<br>
modparam("tls", "certificate", "ser1_cert.pem")
<br>
modparam("tls", "private_key", "privkey.pem")
<br>
modparam("tls", "ca_list", "cacert.pem")
<br>
modparam("tls", "verify_certificate", 1)
<br>
modparam("tls", "require_certificate", 1)<br><br>i start kamailio ok. the log have line :<br><br><pre>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:175]: TLSc<default>: tls_method=9
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:185]: TLSc<default>: certificate='/usr/local/etc/kamailio//tls/user/user-cert.pem'
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:190]: TLSc<default>: ca_list='/usr/local/etc/kamailio//tls/user/user-calist.pem'
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:193]: TLSc<default>: require_certificate=1
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:198]: TLSc<default>: cipher_list='(null)'
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:203]: TLSc<default>: private_key='/usr/local/etc/kamailio//tls/user/user-privkey.pem'
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:206]: TLSc<default>: verify_certificate=1
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:209]: TLSc<default>: verify_depth=9
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: INFO: tls [tls_domain.c:331]: TLSc<default>: Server MUST present valid certificate
Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3103]: WARNING: tls [tls_domain.c:395]: tls: set_ssl_options: <span style="color: rgb(84, 141, 212);">openssl SSL_OP_TLS_BLOCK_PADDING bug workaround enabled (openssl version 90802f)
</span>Sep 4 05:17:42 appliance /usr/local/sbin/kamailio[3116]: INFO: ctl [io_listener.c:224]: io_listen_loop: using epoll_lt io watch method (config)<br><br>when i add certificate to 3CX phone, i register, the log in server is :<br><br> SSL error:error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate.<br><br>so i thing my problem is the certificate,or the bug in opnessl, my openssl version is OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008</pre>i used QJsimple is have the same problem.<br><br>please help me to check it again or suggest what i do to fix it.<br>thanks and regards,<br>Peter Green.<br><br><br><br> </body>
</html>