<html><head></head><body><div class="ydp104f9ca5yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div><div dir="ltr" data-setdir="false">please ignore this :) I got it fixed.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I haven't set default tls params properly. which will be use for outgoing connections .</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><div>modparam("tls_mgm", "certificate", "/etc/opensips/tls/default.crt")<br>modparam("tls_mgm", "private_key","/etc/opensips/tls/default.key")<br>modparam("tls_mgm", "ca_list", "/etc/opensips/tls/ca-default.crt")<br>modparam("tls_mgm", "ca_dir", "/etc/ssl/certs/")<br>modparam("tls_mgm","verify_cert", "1")<br>modparam("tls_mgm","require_cert", "1")<br><br></div><div><br></div><div dir="ltr" data-setdir="false">All good now :)</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><div>Mar 23 10:04:55 ip-172-31-36-39 /usr/sbin/opensips[13025]: INFO:core:probe_max_sock_buff: using snd buffer of 416 kb<br>Mar 23 10:04:55 ip-172-31-36-39 /usr/sbin/opensips[13025]: INFO:core:init_sock_keepalive: TCP keepalive enabled on socket 6<br>Mar 23 10:04:55 ip-172-31-36-39 /usr/sbin/opensips[13025]: NOTICE:tls_mgm:verify_callback: depth = 2<br>Mar 23 10:04:55 ip-172-31-36-39 /usr/sbin/opensips[13025]: NOTICE:tls_mgm:verify_callback: preverify is good: verify return: 1<br>Mar 23 10:04:55 ip-172-31-36-39 /usr/sbin/opensips[13025]: NOTICE:tls_mgm:verify_callback: depth = 1<br>Mar 23 10:04:55 ip-172-31-36-39 /usr/sbin/opensips[13025]: NOTICE:tls_mgm:verify_callback: preverify is good: verify return: 1<br>Mar 23 10:04:55 ip-172-31-36-39 /usr/sbin/opensips[13025]: NOTICE:tls_mgm:verify_callback: depth = 0<br>Mar 23 10:04:55 ip-172-31-36-39 /usr/sbin/opensips[13025]: NOTICE:tls_mgm:verify_callback: preverify is good: verify return: 1<br>Mar 23 10:04:56 ip-172-31-36-39 /usr/sbin/opensips[13025]: INFO:proto_tls:tls_connect: New TLS connection to 52.114.75.24:5061 established<br>Mar 23 10:04:56 ip-172-31-36-39 /usr/sbin/opensips[13025]: INFO:proto_tls:tls_dump_cert_info: tls_connect: server TLS certificate subject: /CN=sip.pstnhub.microsoft.com, issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=Microsoft IT/CN=Microsoft IT TLS CA 4<br>Mar 23 10:04:56 ip-172-31-36-39 /usr/sbin/opensips[13025]: INFO:proto_tls:tls_dump_cert_info: tls_connect: local TLS client certificate subject: /C=AU/ST=/L=/O= Pty. Ltd./CN=*.x.com.au, issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=GeoTrust RSA CA 2018<br><br></div><div><br></div></div></div><div><br></div><div class="ydp104f9ca5signature"><div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;">Distinguishing <font color="#0000ff"><strong>What</strong></font> && <font color="#ff007f"><strong>How</strong></font> !</font></div></div></div></div>
<div><br></div><div><br></div>
</div><div id="yahoo_quoted_5303533516" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Monday, 23 March 2020, 3:26:03 pm GMT+5:30, Pasan Meemaduma via Users <users@lists.opensips.org> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="yiv9860751233"><div><div class="yiv9860751233ydp8fc827fyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div><div dir="ltr">Hi Guys,</div><div dir="ltr"><br></div><div dir="ltr">I'm trying to setup ms teams integration as per <a rel="nofollow" target="_blank" href="https://blog.opensips.org/2019/09/16/opensips-as-ms-teams-sbc/" class="yiv9860751233">https://blog.opensips.org/2019/09/16/opensips-as-ms-teams-sbc/</a></div><div><br></div><div>I got everything setup and when start opensips. I get below error message.</div><div><br></div><div dir="ltr">I'm out of ideas as I could connect to microsoft servers using the openssl command manually. Can anyone give a clue as to whats wrong?</div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">Software versions<br></div><div dir="ltr"><div>opensips -V<br>version: opensips 2.4.4 (x86_64/linux)</div><div><br></div><div dir="ltr"><span>openssl 1.1.0l-1~deb9u1</span><br> </div></div><div><br></div><div><br></div><div dir="ltr"><br></div><div dir="ltr">config file</div><div dir="ltr"><br></div><div dir="ltr"><div><br>modparam("tls_mgm", "server_domain", "dom1=172.31.36.39:5061")<br>#modparam("tls_mgm", "match_ip_address", "[dom1]172.31.36.39:5061")<br>#modparam("tls_mgm", "match_sip_domain", "[dom1]msteams-sbc.x.com")<br>modparam("tls_mgm","verify_cert", "[dom1]1")<br>modparam("tls_mgm","require_cert", "[dom1]1")<br>modparam("tls_mgm","tls_method", "[dom1]TLSv1_2")<br>modparam("tls_mgm","certificate", "[dom1]/etc/tls/x.com/x.com.crt")<br>modparam("tls_mgm","private_key", "[dom1]/etc/tls/x.com/x.com.au.key")<br>modparam("tls_mgm", "ca_list", "[dom1]/etc/tls/x.com/x.com.-ca.crt")<br>modparam("tls_mgm", "ca_dir", "[dom1]/etc/ssl/certs/")<br>modparam("tls_mgm", "tls_handshake_timeout", 300)<br>modparam("proto_tls", "tls_max_msg_chunks", 8)<br><br></div><div><br></div></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">Error in syslog</div><div dir="ltr"><div>Mar 23 09:39:33 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:core:probe_max_sock_buff: using snd buffer of 416 kb<br>Mar 23 09:39:33 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:core:init_sock_keepalive: TCP keepalive enabled on socket 6<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: depth = 1<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: subject = /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=Microsoft IT/CN=Microsoft IT TLS CA 4<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: verify error:num=20:unable to get local issuer certificate<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: something wrong with the cert ... error code is 20 (check x509_vfy.h)<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: NOTICE:tls_mgm:verify_callback: verify return:0<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:proto_tls:tls_connect: New TLS connection to 52.114.148.0:5061 established<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:proto_tls:tls_dump_cert_info: tls_connect: server TLS certificate subject: /CN=sip.pstnhub.microsoft.com, issuer: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=Microsoft IT/CN=Microsoft IT TLS CA 4<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: WARNING:proto_tls:tls_connect: TLS server certificate verification failed<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: ERROR:proto_tls:tls_dump_verification_failure: unable to get local issuer certificate<br>Mar 23 09:39:34 ip-172-31-36-39 /usr/sbin/opensips[12859]: INFO:proto_tls:tls_dump_cert_info: tls_connect: local TLS client certificate subject: /C=AU/ST=Victoria/L=x x/O=x x Pty. Ltd./CN=*.x.com, issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=GeoTrust RSA CA 2018<br><br></div><div><br></div></div><div><br></div><div class="yiv9860751233ydp8fc827fsignature"><div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div dir="ltr"> I can successfully connect to ms servers using openssl command as below,</div><div dir="ltr"><br></div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div dir="ltr"> <span>openssl s_client -cert /etc/tls/x.com/x.com.crt -key /etc/tls/x.com/x.com.key -CApath /etc/ssl/certs/ -connect sip.pstnhub.microsoft.com:5061</span></div><div> </div><div dir="ltr">output<br></div><div dir="ltr"><div>SSL-Session:<br> Protocol : TLSv1.2<br> Cipher : ECDHE-RSA-AES256-GCM-SHA384<br> Session-ID: DD3600000099EA880BECA036929C403E2F6431288A6F4E5B56199CEB8A2E2811<br> Session-ID-ctx: <br> Master-Key: DFD1ED75E7D5637BC57C78E0FA17D55B565527BB8DB4789D19F696A034DC1FAB1C0B3AB5C373CCA83286BE5C8BF4817A<br> PSK identity: None<br> PSK identity hint: None<br> SRP username: None<br> Start Time: 1584957003<br> Timeout : 7200 (sec)<br> Verify return code: 0 (ok)<br><br></div><div><br></div></div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div dir="ltr"> Regards,</div><div dir="ltr">Pasan<br></div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;"></font> </div><div><font style="BACKGROUND-COLOR:#e6e6e6;">Distinguishing <font color="#0000ff"><strong>What</strong></font> && <font color="#ff007f"><strong>How</strong></font> !</font></div></div></div></div></div></div></div>_______________________________________________<br>Users mailing list<br><a ymailto="mailto:Users@lists.opensips.org" href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a><br><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br></div>
</div>
</div></body></html>