<div dir="ltr">Hey Ben, <div><br></div><div>Thank you for your email. I really misunderstood this topic and wrote it wrong. </div><div><br></div><div>Now finally I have a new error. It's about the local issuer certificate. I'm using Letsencrypt and Microsoft's using Digicert as CA</div><div><br></div><div> /usr/sbin/opensips[24021]: NOTICE:tls_openssl:verify_callback: depth = 1, verify failure</div><div> /usr/sbin/opensips[24021]: NOTICE:tls_openssl:verify_callback: subject = /C=US/O=Microsoft Corporation/CN=Microsoft Azure RSA TLS Issuing CA 03<br> /usr/sbin/opensips[24021]: NOTICE:tls_openssl:verify_callback: issuer = /C=US/O=DigiCert Inc/OU=<a href="http://www.digicert.com/CN=DigiCert" target="_blank">www.digicert.com/CN=DigiCert</a> Global Root G2<br> /usr/sbin/opensips[24021]: NOTICE:tls_openssl:verify_callback: verify error: unable to get local issuer certificate [error=20]<br> /usr/sbin/opensips[24021]: ERROR:tls_openssl:openssl_tls_async_connect: New TLS connection to <a href="http://52.114.132.46:5061" target="_blank">52.114.132.46:5061</a> failed<br></div><div><br></div><div>I'll troubleshoot this error, and make some tests using openssl to see what happens here. </div><div><br></div><div>Thank you for your help. </div><div><br></div><div>Regards, </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Mar 11, 2025 at 3:09 PM Ben Newlin <<a href="mailto:Ben.Newlin@genesys.com" target="_blank">Ben.Newlin@genesys.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>
<div lang="EN-US">
<div>
<p class="MsoNormal"><span style="font-size:11pt">The configuration values for the “client_sip_domain_avp” and “client_tls_domain_avp” modparams are supposed to be the names of AVP variables, not domain names. They also represent 2 different ways to specify
the desired client. The “match_ip_address” modparam is a third way to specify the client, or can be used in conjunction with SIP domain for additional flexibility.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">First, if you only have one client as in your config example then both IP and domain matching are unnecessary. You can simply specify the client to match everything and all outbound TLS will use that client:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">src/main/config/forward/module.cfg:45:modparam("tls_mgm", "match_ip_address", "[</span><span style="font-size:12pt">
</span><span style="font-family:"Aptos Mono"">client]*")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">src/main/config/forward/module.cfg:46:modparam("tls_mgm", "match_sip_domain", "[</span><span style="font-size:12pt">
</span><span style="font-family:"Aptos Mono"">client]*")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">If you do have multiple clients or you just want to directly specify the client anyway, then you can choose one of the methods to do so.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">A. SIP Domain/IP Matching (see [1], [2], [3], [4])</span><span style="font-size:11pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">1. Specify the SIP domain and/or IP which matches the client uses the respective modparams:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">modparam("tls_mgm", "match_ip_address", "[client]x.x.x.x:5061")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">modparam("tls_mgm", "match_sip_domain", "[client]<a href="http://sbc.mydomain.com" target="_blank">sbc.mydomain.com</a>")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">2. Specify the name of the AVP which your config script will populate with the SIP domain value to be used for matching against the client. This is only required if you want SIP Domain matching; it’s not required
for IP matching.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">modparam("tls_mgm", "client_sip_domain_avp", "tls_client_sip")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">3. In your config script, set the named AVP to the appropriate domain for the message currently being processed. This could be the Request-URI domain ($rd), Destination URI domain ($dd), or anything else you
like.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">$avp(tls_client_sip) := “<a href="http://sbc.mydomain.com" target="_blank">sbc.mydomain.com</a>”; // or $rd or $dd or whatever<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">B. TLS Client Name Matching (see [5])<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">1. Specify the TLS client domain name via the modparam:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">modparam("tls_mgm", "client_domain", "client")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">2. Specify the name of the AVP which your config script will populate with the TLS client name to be used:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">modparam("tls_mgm", "client_tls_domain_avp", “tls_client_name")<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">3. In your config script, set the named AVP to the name of the TLS client you wish to use for the message currently being processed.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Aptos Mono"">$avp(tls_client_name) := “client”;</span><span style="font-size:11pt"><br>
<br>
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">[1] - <a href="https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#param_match_sip_domain" target="_blank">
https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#param_match_sip_domain</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">[2] - <a href="https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#param_match_ip_address" target="_blank">
https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#param_match_ip_address</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">[3] - <a href="https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#param_client_sip_domain_avp" target="_blank">
https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#param_client_sip_domain_avp</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">[4] - <a href="https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#domains-param" target="_blank">
https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#domains-param</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt">[5] - <a href="https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#param_client_tls_domain_avp" target="_blank">
https://opensips.org/html/docs/modules/3.6.x/tls_mgm.html#param_client_tls_domain_avp</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Ben Newlin</span><span style="font-size:11pt"><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div id="m_-199110141426129990m_3023878463819571359mail-editor-reference-message-container">
<div>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size:12pt;color:black">From:
</span></b><span style="font-size:12pt;color:black">Users <<a href="mailto:users-bounces@lists.opensips.org" target="_blank">users-bounces@lists.opensips.org</a>> on behalf of Thiago Lopes via Users <<a href="mailto:users@lists.opensips.org" target="_blank">users@lists.opensips.org</a>><br>
<b>Date: </b>Tuesday, March 11, 2025 at 12:49</span><span style="font-size:12pt;font-family:Arial,sans-serif;color:black"> </span><span style="font-size:12pt;color:black">PM<br>
<b>To: </b>Bogdan-Andrei Iancu <<a href="mailto:bogdan@opensips.org" target="_blank">bogdan@opensips.org</a>><br>
<b>Cc: </b>OpenSIPS users mailling list <<a href="mailto:users@lists.opensips.org" target="_blank">users@lists.opensips.org</a>><br>
<b>Subject: </b>Re: [OpenSIPS-Users] MS Teams and SBC integration<u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<div>
<table border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none">
<tbody>
<tr>
<td style="border:1pt solid rgb(182,0,0);background:white;padding:0.75pt">
<p class="MsoNormal"><b><span style="font-size:12pt;font-family:Calibri,sans-serif;color:rgb(182,0,0)"> EXTERNAL EMAIL - Please use caution with links and attachments <u></u><u></u></span></b></p>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal"><span style="font-size:12pt;font-family:Helvetica"><u></u> <u></u></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:12pt;font-family:Helvetica">
<hr size="1" width="100%" align="center">
</span></div>
</div>
<p class="MsoNormal"><span style="font-size:12pt">Hi Bogdan-Andrei, <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt">I already did this too. The result in the log file was the same. <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt">Actually, even with changing the tls_mgm module, or from openssl to wolfssl, I saw that the module who answer with error is proto_tls: <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"> /usr/sbin/opensips[4634]: DBG:core:init_sock_keepalive: TCP keepalive enabled on socket 5<br>
/usr/sbin/opensips[4634]: DBG:core:print_ip: tcpconn_new: new tcp connection to: 52.114.76.76<br>
/usr/sbin/opensips[4634]: DBG:core:tcpconn_new: on port 5061, proto 3<br>
<b> /usr/sbin/opensips[4634]: ERROR:proto_tls:proto_tls_conn_init: no TLS client domain found</b><br>
/usr/sbin/opensips[4634]: ERROR:core:tcp_conn_create: failed to do proto 3 specific init for conn 0x7f794a63d080<br>
/usr/sbin/opensips[4634]: DBG:core:tcpconn_destroy: delaying (0x7f794a63d080, flags 0018) ref = -1 ...<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt">My actual cfg file: <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt">#loadmodule "tls_openssl.so"<br>
loadmodule "tls_wolfssl.so"<br>
<br>
####TLS module<br>
loadmodule "tls_mgm.so"<br>
/*#first the server domain */<br>
modparam("tls_mgm", "server_domain", "default") <br>
modparam("tls_mgm", "certificate", "[default]/etc/letsencrypt/live/</span><a href="http://sbc.mydomain.com/fullchain.pem" target="_blank"><span style="font-size:12pt">sbc.mydomain.com/fullchain.pem</span></a><span style="font-size:12pt">")
<br>
modparam("tls_mgm", "private_key", "[default]/etc/letsencrypt/live/</span><a href="http://sbc.mydomain.com/privkey.pem" target="_blank"><span style="font-size:12pt">sbc.mydomain.com/privkey.pem</span></a><span style="font-size:12pt">")
<br>
modparam("tls_mgm", "ca_list", "[default]/etc/letsencrypt/live/</span><a href="http://sbc.mydomain.com/inter.pem" target="_blank"><span style="font-size:12pt">sbc.mydomain.com/inter.pem</span></a><span style="font-size:12pt">")
<br>
modparam("tls_mgm", "match_ip_address", "[default]x.x.x.x:5061")<br>
modparam("tls_mgm", "match_sip_domain", "[default]</span><a href="http://sbc.mydomain.com" target="_blank"><span style="font-size:12pt">sbc.mydomain.com</span></a><span style="font-size:12pt">")
<br>
#modparam("tls_mgm", "verify_cert", "[default]0")<br>
#modparam("tls_mgm", "require_cert", "[default]1")<br>
#modparam("tls_mgm", "ciphers_list", "[default]AES128-SHA256:AES256-SHA")<br>
modparam("tls_mgm", "tls_method", "[default]SSLv23")<br>
<br>
<br>
# #and the client domain
<br>
modparam("tls_mgm", "client_domain", "client") <br>
modparam("tls_mgm", "certificate", "[client]/etc/letsencrypt/live/</span><a href="http://sbc.mydomain.com/fullchain.pem" target="_blank"><span style="font-size:12pt">sbc.mydomain.com/fullchain.pem</span></a><span style="font-size:12pt">")
<br>
modparam("tls_mgm", "private_key", "[client]/etc/letsencrypt/live/</span><a href="http://sbc.mydomain.com/privkey.pem" target="_blank"><span style="font-size:12pt">sbc.mydomain.com/privkey.pem</span></a><span style="font-size:12pt">")
<br>
modparam("tls_mgm", "ca_list", "[client]/etc/letsencrypt/live/</span><a href="http://sbc.mydomain.com/inter.pem" target="_blank"><span style="font-size:12pt">sbc.mydomain.com/inter.pem</span></a><span style="font-size:12pt">")<br>
#modparam("tls_mgm", "ca_dir", "[client]/etc/letsencrypt/live/</span><a href="http://sbc.mydomain.com/" target="_blank"><span style="font-size:12pt">sbc.mydomain.com/</span></a><span style="font-size:12pt">")
<br>
modparam("tls_mgm", "match_sip_domain", "[client]</span><a href="http://sbc.mydomain.com" target="_blank"><span style="font-size:12pt">sbc.mydomain.com</span></a><span style="font-size:12pt">")<br>
modparam("tls_mgm", "match_ip_address", "[client]x.x.x.x:5061")<br>
<br>
#modparam("tls_mgm", "verify_cert", "[client]0")<br>
# modparam("tls_mgm", "require_cert", "[client]1")<br>
# modparam("tls_mgm", "ciphers_list", "[client]AES128-SHA256:AES256-SHA")<br>
modparam("tls_mgm", "tls_method", "[client]SSLv23")<br>
<br>
<br>
<br>
modparam("tls_mgm", "tls_library", "wolfssl")<br>
#modparam("tls_mgm", "tls_handshake_timeout", 300)<br>
modparam("tls_mgm", "client_sip_domain_avp", "</span><a href="http://sbc.mydomain.com" target="_blank"><span style="font-size:12pt">sbc.mydomain.com</span></a><span style="font-size:12pt">")<br>
modparam("tls_mgm", "client_tls_domain_avp", "</span><a href="http://sbc.mydomain.com" target="_blank"><span style="font-size:12pt">sbc.mydomain.com</span></a><span style="font-size:12pt">")<br>
<br>
loadmodule "proto_tls.so"<br>
#modparam("proto_tls", "tls_async", 0)<br>
modparam("proto_tls", "tls_handshake_timeout", 300)<br>
modparam("proto_tls", "tls_send_timeout", 2000)<br>
modparam("proto_tls", "tls_max_msg_chunks", 8)<br>
modparam("proto_tls", "cert_check_on_conn_reusage", 1)<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt">Enable or no the client_sip_domain_avp, client_tls_domain_avp, match_sip_domain and match_ip_address in any order do not show any different results;<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt">I thought maybe make a rollback, from 3.4.11 to another version where someone did this connection with Teams successfully .<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12pt">In past versions here in this list I read that some fellows passed to the same error. But there was an error in the cfg file. I did several alterations in this file, modules and certificates. The only change
that I didn't make was changing the version. <u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></blockquote></div>