<div dir="ltr"><div>HI Callum, <br></div><div><br></div><div>Currently I stuck with PEM certificates because my configuration is for testing only (not productive). One last thing to check with you, I am unable to use 1_2 version in my opensips. Actually, opensips restarted without error but I am unable to perform handshake.</div><div><br></div><div>Regards,<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jan 23, 2020 at 11:15 AM Callum Guy <<a href="mailto:callum.guy@x-on.co.uk">callum.guy@x-on.co.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Ali,<br><div><br></div><div>Glad the suggestions were helpful.</div><div><br></div><div>The certificate is just a regular SSL cert, in PEM format just with a different file extension. Depending on your implementation you might want to look into public verifiable certificates (if you're public facing) - available for free if you want to check out a service like <a href="https://letsencrypt.org/" target="_blank">https://letsencrypt.org/</a>.</div><div><br></div><div>Callum</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 22 Jan 2020 at 22:09, Ali Alawi <<a href="mailto:goatolina@gmail.com" target="_blank">goatolina@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Dear Callum, <br></div><div>Thanks a lot. it help me to establish a TLS connection with ECDH suite. but I used my own certificate.pem rather than the one you mentioned sip.crt. Actually, I couldn't figure out from where I can get this kind of .crt files.<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jan 20, 2020 at 11:49 AM Callum Guy <<a href="mailto:callum.guy@x-on.co.uk" target="_blank">callum.guy@x-on.co.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi Ali,<br></div><div><br></div><div>You'll need to setup your cipher list and DH file. You can generate a DH param file like this: <b>openssl dhparam -out dhparam.pem 4096</b></div><div><br></div><div>If you want to review locally available cipher suites you can run: <b>openssl ciphers -v</b></div><div><br></div><div>The OpenSIPs documentation clarifies the module configuration options however the following setup will provide a set of strong ciphers and maybe you can pick from this to add to your existing config to get things working.</div><div><br></div>modparam("tls_mgm", "dh_params", "/etc/pki/tls/certs/dhparam.pem")<br>modparam("tls_mgm", "ec_curve", "secp384r1")<br>modparam("tls_mgm", "ciphers_list", "EECDH+AESGCM,EDH+AESGCM,AES256+EECDH,AES256+EDH")<br>modparam("tls_mgm", "verify_cert", "1")<br>modparam("tls_mgm", "require_cert", "1")<br>modparam("tls_mgm", "tls_method", "TLSv1_2")<br>modparam("tls_mgm", "certificate", "/etc/pki/tls/certs/sip.crt")<br>modparam("tls_mgm", "private_key", "/etc/pki/tls/private/sip.key")<br>modparam("tls_mgm", "ca_list", "/etc/pki/tls/certs/ca-bundle.crt")<br>modparam("tls_mgm", "ca_dir", "/etc/pki/tls/certs/")<br><div><br></div><div>Good luck,</div><div><br></div><div>Callum</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 18 Jan 2020 at 20:32, Ali Alawi <<a href="mailto:goatolina@gmail.com" target="_blank">goatolina@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hello every one.</div><div>I am trying to test TLS in OpenSIPS 2.4, the testing is going fine but it only support certain cipher suite methods such as (
<table style="border-collapse:collapse;width:48pt" width="64" cellspacing="0" cellpadding="0" border="0">
<colgroup><col style="width:48pt" width="64">
</colgroup><tbody><tr style="height:15pt" height="20">
<td style="height:15pt;width:48pt;font-size:9.5pt;font-family:"Courier New",monospace;padding-top:1px;padding-right:1px;padding-left:1px;color:black;font-weight:400;font-style:normal;text-decoration:none;vertical-align:bottom;border:medium none;white-space:nowrap" width="64" height="20">AES256-GCM-SHA384,AES256-SHA256,AES256-SHA,CAMELLIA256-SHA,AES128-SHA,SEED-SHA,CAMELLIA128-SHA,RC4-SHA,DES-CBC3-SHA</td>
</tr>
</tbody></table>
)</div><div>For some reason, I need to use ECDHE cipher suites but it is unsupported here.</div><div>How can I include ECDHE in my TLS test?<br></div><div>
<table style="border-collapse:collapse;width:209pt" width="278" cellspacing="0" cellpadding="0" border="0">
<colgroup><col style="width:209pt" width="278">
</colgroup><tbody><tr style="height:15pt" height="20">
<td style="height:15pt;width:209pt;background:white none repeat scroll 0% 0%;padding-top:1px;padding-right:1px;padding-left:1px;color:black;font-size:11pt;font-weight:400;font-style:normal;text-decoration:none;font-family:Calibri,sans-serif;vertical-align:bottom;border:medium none;white-space:nowrap" width="278" height="20">BTW, I am using OpenSSL
1.0.2g <br><br>ALi<br></td>
</tr>
</tbody></table>
</div></div>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div>
<br>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;text-align:justify"><font size="3" face="Verdana"><span style="font-size:8px;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline"></span></font></p><div><img src="https://www.x-on.co.uk/email/footer/General-Practice-Awards-winners.jpg"></div><div><br></div><div><div><div><font size="4"><b><sup><font face="Verdana">0333 332 0000 | <a href="http://www.x-on.co.uk" target="_blank">www.x-on.co.uk</a> | <sub> </sub></font></sup></b></font><font size="4"><b><sub><sup><font face="Verdana"><a href="https://www.linkedin.com/company/x-on" target="_blank"><img src="http://www.x-on.co.uk//images/icon/linkedin.png" width="24" height="24"></a> <a href="https://www.facebook.com/XonTel" target="_blank"><img src="http://www.x-on.co.uk//images/icon/facebook.png" width="24" height="24"></a> <a href="https://twitter.com/xonuk" target="_blank"><img src="http://www.x-on.co.uk//images/icon/twitter.png" width="24" height="24"></a></font></sup></sub> </b></font><br><p><span style="font-size:6pt;font-family:Verdana;color:black">X-on
is a trading name of Storacall Technology Ltd a limited company registered in
England and Wales.<br>
Registered Office : Avaland House, 110 London Road, Apsley, Hemel Hempstead,
Herts, HP3 9SD. Company Registration No. 2578478.<br>
The information in this e-mail is confidential and for use by the addressee(s)
only. If you are not the intended recipient, please notify X-on immediately on <span>+44(0)333 332 0000</span> and delete the<br>message from your computer. If you are not a named addressee you must not use,
disclose, disseminate, distribute, copy, print or reply to this email. </span><span style="font-size:6pt;font-family:Verdana;color:black">Views
or opinions expressed by an individual<br>within this email may not necessarily
reflect the views of X-on or its associated companies. Although X-on routinely
screens for viruses, addressees should scan this email and any attachments<br>for
viruses. X-on makes no representation or warranty as to the absence of viruses
in this email or any attachments.</span></p>
<p><span style="font-size:6pt;font-family:Verdana;color:black"></span><font size="2"><span style="font-size:6pt;font-family:Verdana;color:black"></span></font></p></div></div></div>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div>
<br>
<p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;text-align:justify"><font size="3" face="Verdana"><span style="font-size:8px;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline"></span></font></p><div><img src="https://www.x-on.co.uk/email/footer/General-Practice-Awards-winners.jpg"></div><div><br></div><div><div><div><font size="4"><b><sup><font face="Verdana">0333 332 0000 | <a href="http://www.x-on.co.uk" target="_blank">www.x-on.co.uk</a> | <sub> </sub></font></sup></b></font><font size="4"><b><sub><sup><font face="Verdana"><a href="https://www.linkedin.com/company/x-on" target="_blank"><img src="http://www.x-on.co.uk//images/icon/linkedin.png" width="24" height="24"></a> <a href="https://www.facebook.com/XonTel" target="_blank"><img src="http://www.x-on.co.uk//images/icon/facebook.png" width="24" height="24"></a> <a href="https://twitter.com/xonuk" target="_blank"><img src="http://www.x-on.co.uk//images/icon/twitter.png" width="24" height="24"></a></font></sup></sub> </b></font><br><p><span style="font-size:6pt;font-family:Verdana;color:black">X-on
is a trading name of Storacall Technology Ltd a limited company registered in
England and Wales.<br>
Registered Office : Avaland House, 110 London Road, Apsley, Hemel Hempstead,
Herts, HP3 9SD. Company Registration No. 2578478.<br>
The information in this e-mail is confidential and for use by the addressee(s)
only. If you are not the intended recipient, please notify X-on immediately on <span>+44(0)333 332 0000</span> and delete the<br>message from your computer. If you are not a named addressee you must not use,
disclose, disseminate, distribute, copy, print or reply to this email. </span><span style="font-size:6pt;font-family:Verdana;color:black">Views
or opinions expressed by an individual<br>within this email may not necessarily
reflect the views of X-on or its associated companies. Although X-on routinely
screens for viruses, addressees should scan this email and any attachments<br>for
viruses. X-on makes no representation or warranty as to the absence of viruses
in this email or any attachments.</span></p>
<p><span style="font-size:6pt;font-family:Verdana;color:black"></span><font size="2"><span style="font-size:6pt;font-family:Verdana;color:black"></span></font></p></div></div></div>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div>