<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FR" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Hello Mickael
<br>
<br>
if the goal is only to keep your key out of opensips plain sight, the simplest way is using exec.so module, load the private key from a local file or an external data source with an external command, and then store it securely in the local cache for future
calls stirshaken signing. <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">you could also use the rest_client.so module and get your key/certificate from a secure external webservice (my personal fav)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">another option is avpops module to get your private key from a sql database on demand (or sqlcacher to full cache your table on script startup)<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">in case you're considering using the avpops module with its default table, the value column can by default only hold 128 characters. for an RSA private key in PEM format, it can go up
to 800 chars.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">hope this helps<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>De :</b> Users <users-bounces@lists.opensips.org> <b>De la part de</b> Mickael Hubert<br>
<b>Envoyé :</b> lundi 29 mai 2023 14:55<br>
<b>À :</b> OpenSIPS users mailling list <users@lists.opensips.org><br>
<b>Objet :</b> Re: [OpenSIPS-Users] Stir Shaken: Failed to load certificate<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<div>
<p class="MsoNormal">Can you tell me what is the best way to load our private key please ?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">It would be great not to have it as clear text in opensips's configuration.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">thanks in advance<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Le lun. 21 nov. 2022 à 13:39, ryan embgrets <<a href="mailto:rembgrets@gmail.com">rembgrets@gmail.com</a>> a écrit :<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal">That was it. <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Working flawlessly.Thanks Vlad Patrascu<br>
<br>
Ryan<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, 21 Nov 2022 at 17:24, Vlad Patrascu <<a href="mailto:vladp@opensips.org" target="_blank">vladp@opensips.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal">Hi Ryan,<br>
<br>
You have to provide to the stir_shaken_auth() function the actual <br>
content of the certificate file and not just the path. The same goes for <br>
the private key.<br>
<br>
Regards,<br>
<br>
-- <br>
Vlad Patrascu<br>
OpenSIPS Core Developer<br>
<a href="http://www.opensips-solutions.com" target="_blank">http://www.opensips-solutions.com</a><br>
<br>
On 21.11.2022 14:02, ryan embgrets wrote:<br>
> Greetings<br>
><br>
> I am trying to generate an Identity header by using the stir_shaken <br>
> module of the opensips.<br>
><br>
> But I am encountering the below error each time upon call.<br>
><br>
> Nov 21 11:15:20 local /usr/sbin/opensips[5051]: <br>
> ERROR:stir_shaken:w_stir_verify: Failed to load certificate<br>
> Nov 21 11:15:20 local /usr/sbin/opensips[5051]: <br>
> ERROR:stir_shaken:load_cert: Failed to parse certificate<br>
><br>
> #Module section.<br>
> loadmodule "stir_shaken.so"<br>
><br>
> route{<br>
><br>
> $var(cert) = "/etc/opensips/certs.pem";<br>
> $var(privKey) = "/etc/opensips/key.pem";<br>
> stir_shaken_auth("A", "",$var(cert), $var(privKey), <br>
> "<a href="https://domain.org/cert.pem" target="_blank">https://domain.org/cert.pem</a>");<br>
> }<br>
><br>
> Though the cert looks valid, has proper permission for the opensips to <br>
> access them and cross checked with openssl for the verification.<br>
><br>
> Any pointer on what might be causing this?<br>
><br>
> Ryan<br>
><br>
> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
> <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">
http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal">_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>