<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p></p>
<div>Hi Guys,</div>
<div><br>
</div>
<div>Sorry for the noise. </div>
<div><br>
</div>
<div>I am testing SIP over TLS and having some issues getting client devices to register having upgraded from opensips 1.11 to 2.2.5.</div>
<div><br>
</div>
<div>Please see my configuration below;</div>
<div><br>
</div>
<div><br>
</div>
<div>opensips 2.2.5</div>
<div><br>
</div>
<div><br>
</div>
<div>listen=tcp:<Public_IP>:5060</div>
<div>listen=tls:<Public_IP>:5061</div>
<div>loadmodule "proto_tcp.so"</div>
<div>loadmodule "proto_udp.so"</div>
<div>loadmodule "proto_tls.so"</div>
<div>loadmodule "tls_mgm.so"</div>
<div><br>
</div>
<div>#Global params</div>
<div>modparam("tls_mgm", "tls_method", "SSLv23")</div>
<div>modparam("tls_mgm", "certificate", "/etc/opensips/tls/rootCA/certs/ssl_certificate.pem")</div>
<div>modparam("tls_mgm", "private_key", "/etc/opensips/tls/rootCA/certs/sip.provider.net.pem")</div>
<div>modparam("tls_mgm", "ca_list", "/etc/opensips/tls/rootCA/certs/IntermediateCA.pem")</div>
<div>modparam("tls_mgm", "require_cert", "0")</div>
<div>modparam("tls_mgm", "verify_cert", "1")</div>
<div>#server domain</div>
<div>modparam("tls_mgm", "server_domain", "sv_dom=<Public_IP>:5061")</div>
<div>modparam("tls_mgm", "certificate", "sv_dom:/etc/opensips/tls/rootCA/certs/ssl_certificate.pem")</div>
<div>modparam("tls_mgm", "private_key", "sv_dom:/etc/opensips/tls/rootCA/certs/sip.provider.net.pem")</div>
<div>modparam("tls_mgm", "ca_list", "sv_dom:/etc/opensips/tls/rootCA/certs/IntermediateCA.pem")</div>
<div>modparam("tls_mgm", "tls_method", "sv_dom:SSLv23")</div>
<div>modparam("tls_mgm", "require_cert", "sv_dom:0")</div>
<div>modparam("tls_mgm", "verify_cert", "sv_dom:1")</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>I am trying to register both Bria client and Yealink and I cant register my device, opensips logs show no errors;</div>
<div><br>
</div>
<div>Sep 8 15:14:56 localhost VU-SIP-Proxy[14664]: INFO:core:probe_max_sock_buff: using snd buffer of 244 kb</div>
<div>Sep 8 15:14:56 localhost VU-SIP-Proxy[14664]: INFO:core:init_sock_keepalive: TCP keepalive enabled on socket 37</div>
<div>Sep 8 15:14:56 localhost VU-SIP-Proxy[14649]: INFO:proto_tls:tls_accept: New TLS connection from 91.151.6.28:10405 accepted</div>
<div>Sep 8 15:14:56 localhost VU-SIP-Proxy[14649]: INFO:proto_tls:tls_accept: Client did not present a TLS certificate</div>
<div>Sep 8 15:14:56 localhost VU-SIP-Proxy[14649]: INFO:proto_tls:tls_dump_cert_info: tls_accept: local TLS server certificate subject: /CN=sip.provider.net, issuer: /C=US/O=GeoTrust Inc./CN=RapidSSL SHA256 CA</div>
<div><br>
</div>
<div>And in a wireshark trace when debugging I see using the private key, there is Client Hello,Server Hello, Certificate, Server Hello Done, then Client Key Exchange, Change Cipher Spec,Finished, then New Session Ticket, change Cipher Spec, then finished.</div>
<div><br>
</div>
<div>At which point I see Close Notify.</div>
<div><br>
</div>
<div>Do I need to specify a Ciphers list? </div>
<div><br>
</div>
<div>I appreciate debugging TLS can be complex but having had it working ok in the testing phase on 1.11 I presume I am just misconfiguring for 2.2?</div>
<div><br>
</div>
<div>Many Thanks!</div>
<div><br>
</div>
<div>Jon</div>
<br>
<p></p>
</div>
</body>
</html>