<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">I have looked into using OpenSIPS with optional mutual TLS. In short, using verify_cert=1 & require_cert=0. In this case, the OpenSIPs acting as a server sends the TLS “Certificate Request” during the handshake and based on the response
the OpenSIPs server decides whether to continue (as either server-only TLS or mutual TLS) or terminate the connection. I have experienced more failures than expected as some remote endpoints are attempting to satisfy the certificate request by sending any
potential certificate that meets the requested criteria. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">During the “Certificate Request” there is an optional parameter allowing the trusted certificate authority distinguished name to be provided in the request. This is defined in OpenSSL’s SSL_CTX_set_client_CA_list. Without this directive
defined the remote client may choose to send a client certificate that meets the only defined parameter (Certificate types); however, in many cases OpenSIPs may reject the client selected certificate. It does not appear that OpenSIPs controls this optional
parameter.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I may have missed this definition in OpenSIPs. This may be a potential feature request. If it has been omitted, I feel that when OpenSIPs is acting as a TLS server, the existing parameter CA_LIST could be defined in the server domain
to provide a set of trusted certificate authorities to pass along as the Certificate Request distinguished name. In this case the remote client peer that is not able to satisfy the scoped Certificate Request can then choose to proceed without mutual authentication
and continue the handshake without offering a client certificate. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>RFC5246</b> 7.4.6 Client Certificate <a href="https://tools.ietf.org/html/rfc5246#section-7.4.6">
https://tools.ietf.org/html/rfc5246#section-7.4.6</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000">TLSv1 Record Layer: Handshake Protocol: Multiple Handshake Messages<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Content Type: Handshake (22)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Version: TLS 1.0 (0x0301)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Length: 14<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Handshake Protocol:
<b>Certificate Request</b><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Handshake Type: Certificate Request (13)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Length: 6<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Certificate types count: 3<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Certificate types (3 types)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Certificate type: RSA Sign (1)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Certificate type: DSS Sign (2)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Certificate type: ECDSA Sign (64)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000">
<span style="background:yellow;mso-highlight:yellow">Distinguished Names Length: 0</span><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Handshake Protocol: Server Hello Done<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Handshake Type: Server Hello Done (14)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Courier New";color:#C00000"> Length: 0<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>OpenSSL SSL_CTX_set_client_CA_list<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_client_CA_list.html">https://www.openssl.org/docs/man1.0.2/man3/SSL_CTX_set_client_CA_list.html</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for your review,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Phil Whitener<o:p></o:p></p>
<p class="MsoNormal"><a href="mailto:phil.whitener@genesys.com">phil.whitener@genesys.com</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>