<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style></head>
<body>
<div><div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12.0pt; line-height:1.3; color:#1F497D"><div><br></div><div><br></div><div id="x_signature-x" class="x_signature_editor" style="">Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF">Nine</a><br></div></div><div id="x_quoted_header" style="clear:both"><hr style="border:none; height:1px; color:#E1E1E1; background-color:#E1E1E1"><div style="border:none; padding:3.0pt 0cm 0cm 0cm"><span style="font-size:11.0pt; font-family:'Calibri','sans-serif'"><b>From:</b> Daniel Lakeland <dlakelan@street-artists.org><br><b>Sent:</b> Thursday, 25 January 2018 6:59 pm<br><b>To:</b> OpenSIPS users mailling list<br><b>Subject:</b> [OpenSIPS-Users] Frequent TLS failures<br></span></div></div><br type="attribution"></div>
<font size="2"><span style="font-size:10pt;"><div class="PlainText">I have set up monit to monitor TLS connectivity for my opensips <br>
instance. It just connects via openssl s_client and greps for errors, it <br>
reboots openssl if it has errors more than a few times in a row.<br>
<br>
I get errors as follows about 3 to 5 times a day:<br>
<br>
Description: status failed (1) -- 140444316333312:error:0407008A:rsa routines:RSA_padding_check_PKCS1_type_1:invalid padding:../crypto/rsa/rsa_pk1.c:67:<br>
140444316333312:error:04067072:rsa routines:rsa_ossl_public_decrypt:padding check failed:../crypto/rsa/rsa_ossl.c:586:<br>
140444316333312:error:1416D07B:SSL routines:tls_process_key_exchange:bad signature:../ssl/statem/statem_clnt.c:1721:<br>
<br>
<br>
rebooting opensips makes them go away for several hours. For example monit rebooted opensips at 2:37 AM, 4:55 AM, and 6:48 AM so far this morning (it's about 8:55 am where I am now).<br>
<br>
This seems suspicious, and btw several other processes use the same certs with no problems day in and day out (prosody jabber server for example, probably some others).<br>
<br>
I suspect some memory gets corrupted in opensips and this causes it to fail to work.<br>
<br>
Opensips is version 2.3.2-1 installed from the opensips apt repository on a mixed Debian system, openssl and libssl = 1.1.0g<br>
<br>
Any thoughts?<br>
<br>
<br>
<br>
_______________________________________________<br>
Users mailing list<br>
Users@lists.opensips.org<br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</div></span></font>
</body>
</html>