<div dir="ltr">Hi Rob Moore,<div><br></div><div>Yes, I have intended to use TLS in client side to verify with server side.</div><div><br></div><div>I have tried to create cert files as : </div><h2 class="" style="color:rgb(0,0,0);font-style:italic;border:1px solid rgb(176,176,176);padding-left:5px;font-family:Helvetica,Arial;font-size:14px;background-color:rgb(236,236,236)">Quick Certificate Howto </h2><div>in <a href="http://kamailio.org/docs/modules/stable/modules/tls.html#tls.debugging">http://kamailio.org/docs/modules/stable/modules/tls.html#tls.debugging</a></div><div><br></div><div>Then, I tried to use Blink phone to user crt file, But I see that I cant add any pem file to this.</div><div><br></div><div>Can you suggest ?</div><div><br></div><div>Thank all,</div><div>ThanhTruong</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr">Thanks,<div>ThanhTruong.</div><div><br></div></div></div></div>
<br><div class="gmail_quote">On Thu, Dec 18, 2014 at 11:28 PM, Rob Moore <span dir="ltr"><<a href="mailto:Rob.Moore@aeriandi.com" target="_blank">Rob.Moore@aeriandi.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="#0563C1" vlink="#954F72">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Hi Thanh,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Are you intending to use Client certificates in your setup?
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">If not, the error “</span>SSL3_GET_CLIENT_CERTIFICATE<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">
“ would lead me to believe that your problem is </span>modparam("tls", "require_certificate", 1)
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">
which when enabled kamailio will require a certificate from the client. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">I’m not an expert with TLS, but this may help depending on what type of TLS setup you are trying to achieve.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> sr-users [mailto:<a href="mailto:sr-users-bounces@lists.sip-router.org" target="_blank">sr-users-bounces@lists.sip-router.org</a>]
<b>On Behalf Of </b>Thanh Truong<br>
<b>Sent:</b> 18 December 2014 15:28<br>
<b>To:</b> kamailio<br>
<b>Subject:</b> [SR-Users] TLS enable false.<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">Hi all,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I have tried several configure TLS in kamailio but no luck.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Please give me some suggestion that I can make it work correctly.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">This is my configure in TLS module.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">modparam("tls", "tls_method", "SSLv23")<u></u><u></u></p>
<p class="MsoNormal">modparam("tls", "private_key", "/usr/local/etc/kamailio/ca/privkey.pem")<u></u><u></u></p>
<p class="MsoNormal">modparam("tls", "certificate", "/usr/local/etc/kamailio/ca/kamailio1_cert.pem")<u></u><u></u></p>
<p class="MsoNormal">modparam("tls", "ca_list", "/usr/local/etc/kamailio/ca/calist.pem")<u></u><u></u></p>
<p class="MsoNormal">modparam("tls", "verify_certificate", 1)<u></u><u></u></p>
<p class="MsoNormal">modparam("tls", "require_certificate", 1)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am only getting issue with verify_certifiate = 1, it i let it to 0, my client can register correctly.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">When I set this flag, i got message from server as:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Dec 18 10:26:31 17237 /usr/local/sbin/kamailio[12655]: ERROR: <core> [tcp_read.c:1279]: tcp_read_req(): ERROR: tcp_read_req: error reading<u></u><u></u></p>
<p class="MsoNormal">Dec 18 10:26:46 17237 /usr/local/sbin/kamailio[12656]: ERROR: tls [tls_server.c:1193]: tls_read_f(): TLS accept:error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did
not return a certificate<u></u><u></u></p>
<p class="MsoNormal">Dec 18 10:26:46 17237 /usr/local/sbin/kamailio[12656]: ERROR: <core> [tcp_read.c:1279]: tcp_read_req(): ERROR: tcp_read_req: error reading<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I Cant add any pem file into client, i have used Blink phone but no luck.<u></u><u></u></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Thank all in advance.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">ThanhTruong.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div>
</div>
<br>_______________________________________________<br>
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br>
<a href="mailto:sr-users@lists.sip-router.org">sr-users@lists.sip-router.org</a><br>
<a href="http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users" target="_blank">http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users</a><br>
<br></blockquote></div></div>