<html><head></head><body><div class="ydp8fc827fyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div><div dir="ltr" data-setdir="false">Hi Guys,</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I'm trying to setup ms teams integration as per <a href="https://blog.opensips.org/2019/09/16/opensips-as-ms-teams-sbc/" rel="nofollow" target="_blank" class="">https://blog.opensips.org/2019/09/16/opensips-as-ms-teams-sbc/</a></div><div><br></div><div>I got everything setup and when start opensips. I get below error message.</div><div><br></div><div dir="ltr" data-setdir="false">I'm out of ideas as I could connect to microsoft servers using the openssl command manually. Can anyone give a clue as to whats wrong?</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Software versions<br></div><div dir="ltr" data-setdir="false"><div>opensips -V<br>version: opensips 2.4.4 (x86_64/linux)</div><div><br></div><div dir="ltr" data-setdir="false"><span>openssl 1.1.0l-1~deb9u1</span><br> </div></div><div><br></div><div><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">config file</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><div><br>modparam("tls_mgm", "server_domain", "dom1=172.31.36.39:5061")<br>#modparam("tls_mgm", "match_ip_address", "[dom1]172.31.36.39:5061")<br>#modparam("tls_mgm", "match_sip_domain", "[dom1]msteams-sbc.x.com")<br>modparam("tls_mgm","verify_cert", "[dom1]1")<br>modparam("tls_mgm","require_cert", "[dom1]1")<br>modparam("tls_mgm","tls_method", "[dom1]TLSv1_2")<br>modparam("tls_mgm","certificate", "[dom1]/etc/tls/x.com/x.com.crt")<br>modparam("tls_mgm","private_key", "[dom1]/etc/tls/x.com/x.com.au.key")<br>modparam("tls_mgm", "ca_list", "[dom1]/etc/tls/x.com/x.com.-ca.crt")<br>modparam("tls_mgm", "ca_dir", "[dom1]/etc/ssl/certs/")<br>modparam("tls_mgm", "tls_handshake_timeout", 300)<br>modparam("proto_tls", "tls_max_msg_chunks", 8)<br><br></div><div><br></div></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Error in syslog</div><div dir="ltr" data-setdir="false"><div>Mar 23 09:39:33 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:core:probe_max_sock_buff: using snd buffer of 416 kb<br>Mar 23 09:39:33 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:core:init_sock_keepalive: TCP keepalive enabled on socket 6<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: depth = 1<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: subject = /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=Microsoft IT/CN=Microsoft IT TLS CA 4<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: verify error:num=20:unable to get local issuer certificate<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: something wrong with the cert ... error code is 20 (check x509_vfy.h)<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: verify return:0<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:proto_tls:tls_connect: New TLS connection to 52.114.148.0:5061 established<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:proto_tls:tls_dump_cert_info: tls_connect: server TLS certificate subject: /CN=sip.pstnhub.microsoft.com, issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=Microsoft IT/CN=Microsoft IT TLS CA 4<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: WARNING:proto_tls:tls_connect: TLS server certificate verification failed<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: ERROR:proto_tls:tls_dump_verification_failure: unable to get local issuer certificate<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:proto_tls:tls_dump_cert_info: tls_connect: local TLS client certificate subject: /C=AU/ST=Victoria/L=x x/O=x x Pty. Ltd./CN=*.x.com, issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=GeoTrust RSA CA 2018<br><br></div><div><br></div></div><div><br></div><div class="ydp8fc827fsignature"><div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div dir="ltr" data-setdir="false"> I can successfully connect to ms servers using openssl command as below,</div><div dir="ltr" data-setdir="false"><br></div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div dir="ltr" data-setdir="false"> <span>openssl s_client -cert /etc/tls/x.com/x.com.crt -key /etc/tls/x.com/x.com.key -CApath /etc/ssl/certs/ -connect sip.pstnhub.microsoft.com:5061</span></div><div> </div><div dir="ltr" data-setdir="false">output<br></div><div dir="ltr" data-setdir="false"><div>SSL-Session:<br> Protocol : TLSv1.2<br> Cipher : ECDHE-RSA-AES256-GCM-SHA384<br> Session-ID: DD3600000099EA880BECA036929C403E2F6431288A6F4E5B56199CEB8A2E2811<br> Session-ID-ctx: <br> Master-Key: DFD1ED75E7D5637BC57C78E0FA17D55B565527BB8DB4789D19F696A034DC1FAB1C0B3AB5C373CCA83286BE5C8BF4817A<br> PSK identity: None<br> PSK identity hint: None<br> SRP username: None<br> Start Time: 1584957003<br> Timeout : 7200 (sec)<br> Verify return code: 0 (ok)<br><br></div><div><br></div></div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div dir="ltr" data-setdir="false"> Regards,</div><div dir="ltr" data-setdir="false">Pasan<br></div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;">Distinguishing <font color="#0000ff"><strong>What</strong></font> && <font color="#ff007f"><strong>How</strong></font> !</font></div></div></div></div></div></body></html>