<div dir="ltr">Hi Karsten,<div>Interesting, i am using centos 7 and /etc/pki/tls/openssl.cnf file does not have any settings forCipherString </div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Jul 16, 2022 at 3:20 AM Karsten Wemheuer <<a href="mailto:kwem@gmx.de">kwem@gmx.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
<br>
looking at some search result shows, that TLS_RSA_WITH_RC4_128_SHA is<br>
insecure and should not be used. Maybe the setting of CipherString in<br>
openssl.cnf is causing the issue. On current Debian it is set like<br>
this DEFAULT@SECLEVEL=2.<br>
<br>
Karsten<br>
<br>
Am Samstag, dem 16.07.2022 um 03:02 +1200 schrieb ideanet help:<br>
> Hi Karsten,<br>
> I thought the same initially but then looks like logs are saying:<br>
> Client used ciphers are:<br>
> TLS_RSA_WITH_RC4_128_MD5<br>
> TLS_RSA_WITH_RC4_128_SHA<br>
> and servers response is cipherSuite TLS_RSA_WITH_RC4_128_SHA<br>
><br>
> isn't it?<br>
><br>
><br>
><br>
> On Sat, Jul 16, 2022 at 1:53 AM Karsten Wemheuer <<a href="mailto:kwem@gmx.de" target="_blank">kwem@gmx.de</a>> wrote:<br>
> > Hi,<br>
> ><br>
> > the snom M9 is pretty old (End of Life 12/2016). Maybe the used<br>
> > ciphers<br>
> > are not secure enough for current TLS.<br>
> ><br>
> > HTH<br>
> ><br>
> > Have a nice day and weekend<br>
> ><br>
> > Karsten<br>
> ><br>
> > Am Samstag, dem 16.07.2022 um 01:20 +1200 schrieb ideanet help:<br>
> > > Hi experts,<br>
> > ><br>
> > > One of my phones (SNOM M9) is not able to register using TLS.<br>
> > ><br>
> > > Here are the logs from opensips and ssldump. Maybe someone can<br>
> > > pinpoint the issue?<br>
> > ><br>
> > ><br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10604]<br>
> > > DBG:core:handle_new_connect: new connection: 0x7f16d2ba3bd8 80<br>
> > flags:<br>
> > > 001c<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10604]<br>
> > > DBG:core:send2worker: to tcp worker 0 (0), 0x7f16d2ba3bd8 rw 1<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:proto_tls:proto_tls_conn_init: looking up TLS server domain<br>
> > > [xx.xx.xx.xx:5061]<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:tls_mgm:tls_find_server_domain: found TLS server domain:<br>
> > > <a href="http://sip.tls.mysipdomain.com" rel="noreferrer" target="_blank">sip.tls.mysipdomain.com</a><br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:tls_openssl:openssl_tls_conn_init: Creating a whole new ssl<br>
> > > connection<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:tls_openssl:openssl_tls_conn_init: Setting in ACCEPT mode<br>
> > > (server)<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > DBG:core:handle_io:<br>
> > > We have received conn 0x7f16d2ba3bd8 with rw 1 on fd 4<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:core:io_watch_add: [TCP_worker] io_watch_add op (4 on 74)<br>
> > > (0x8f91e0, 4, 19, 0x7f16d2ba3bd8,1), fd_no=4/83886<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:proto_tls:tls_read_req: Using the global ( per process ) buff<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:tls_openssl:openssl_tls_update_fd: New fd is 4<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:proto_tls:tls_read_req: SSL accept/connect still pending!<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:proto_tls:tls_read_req: Using the global ( per process ) buff<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > DBG:tls_openssl:openssl_tls_update_fd: New fd is 4<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > ERROR:tls_openssl:openssl_tls_accept: SSL_ERROR_SYSCALL<br>
> > > err=Success(0)<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > ERROR:tls_openssl:openssl_tls_accept: New TLS connection from<br>
> > > myphoneIP.xx.xx:2987 failed to accept<br>
> > > Jul 15 13:02:12 opensips: Jul 15 13:02:12 [10598]<br>
> > > ERROR:proto_tls:tls_read_req: failed to do pre-tls handshake!<br>
> > ><br>
> > > _________________________<br>
> > ><br>
> > > ssldump logs:<br>
> > ><br>
> > ><br>
> > > New TCP connection #3: myphoneIP.xx.xx(2082) <-><br>
> > > <a href="http://sip.tls.mysipdomain.com" rel="noreferrer" target="_blank">sip.tls.mysipdomain.com</a>(5061)<br>
> > > 3 1 0.0280 (0.0280) C>S Handshake<br>
> > > ClientHello<br>
> > > Version 3.1<br>
> > > cipher suites<br>
> > > TLS_RSA_WITH_RC4_128_MD5<br>
> > > TLS_RSA_WITH_RC4_128_SHA<br>
> > > compression methods<br>
> > > NULL<br>
> > > extensions<br>
> > > server_name<br>
> > > host_name: <a href="http://sip.tls.mysipdomain.com" rel="noreferrer" target="_blank">sip.tls.mysipdomain.com</a><br>
> > > ja3 string: 769,4-5,0,,<br>
> > > ja3 fingerprint: 8305e724a7c9f16b323465d289bc54a1<br>
> > > 3 2 0.0353 (0.0072) S>C Handshake<br>
> > > ServerHello<br>
> > > Version 3.1<br>
> > > session_id[0]=<br>
> > ><br>
> > > cipherSuite TLS_RSA_WITH_RC4_128_SHA<br>
> > > compressionMethod NULL<br>
> > > extensions<br>
> > > server_name<br>
> > > ja3s string: 769,5,0<br>
> > > ja3s fingerprint: 99f916287a3ac1de732520956ab94b77<br>
> > > 3 3 0.0353 (0.0000) S>C Handshake<br>
> > > Certificate<br>
> > > 3 4 0.0353 (0.0000) S>C Handshake<br>
> > > ServerHelloDone<br>
> > > 3 0.0653 (0.0299) C>S TCP FIN<br>
> > > 3 0.0656 (0.0003) S>C TCP FIN<br>
> > > _______________________________________________<br>
> > > Users mailing list<br>
> > > <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
> > > <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > Users mailing list<br>
> > <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
> > <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
<br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div>