<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hello Daniel,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks for your answer.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I don’t see much in the debug logs. Except the SSL verification error, the rest looks like the normal SSL handshake and the TCP connection setup:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [io_wait.h:598]: io_watch_del(): DBG: io_watch_del (0xa7edc0, 8, -1, 0x10) fd_no=2 called
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_read.c:1490]: release_tcpconn(): releasing con 0x7f9191b1ade0, state -2, fd=8, id=8 ([<SfB IP1>]:56267 -> [<SfB IP1>]:5061)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_read.c:1491]: release_tcpconn(): extra_data 0x7f9191b39318
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:3243]: handle_tcp_child(): reader response= 7f9191b1ade0, -2 from 0
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: tls [tls_server.c:663]: tls_h_close(): Closing SSL connection 0x7f9191b39318
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [ip_addr.c:229]: print_ip(): tcpconn_new: new tcp connection: <SfB IP1>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:985]: tcpconn_new(): on port 56269, type 3 <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:1295]: tcpconn_add(): hashes: 3769:3996:3198, 9
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [io_wait.h:376]: io_watch_add(): DBG: io_watch_add(0xa25be0, 30, 2, 0x7f9191b1ade0), fd_no=20
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [io_wait.h:598]: io_watch_del(): DBG: io_watch_del (0xa25be0, 30, -1, 0x0) fd_no=21 called
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:4131]: handle_tcpconn_ev(): sending to child, events 1
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:3813]: send2child(): selected tcp worker 1 12(4808) for activity on [tls:<LOCAL IP>:5061], 0x7f9191b1ade0
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_read.c:1566]: handle_io(): received n=8 con=0x7f9191b1ade0, fd=8 <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: tls [tls_server.c:197]: tls_complete_init(): completing tls connection initialization
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: tls [tls_server.c:226]: tls_complete_init(): Using initial TLS domain TLSs<default> (dom 0x7f9191861e98 ctx 0x7f9191887a10 sn [])
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: tls [tls_domain.c:703]: sr_ssl_ctx_info_callback(): SSL handshake started
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:2430]: tcpconn_do_send(): sending...
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:2464]: tcpconn_do_send(): after real write: c= 0x7f9191b1ade0 n=6692 fd=8 <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:2465]: tcpconn_do_send(): buf=#012#026#003#003
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [io_wait.h:376]: io_watch_add(): DBG: io_watch_add(0xa7edc0, 8, 2, 0x7f9191b1ade0), fd_no=1
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:2430]: tcpconn_do_send(): sending...
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:2464]: tcpconn_do_send(): after real write: c= 0x7f9191b1ade0 n=7 fd=8
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">DEBUG: <core> [tcp_main.c:2465]: tcpconn_do_send(): buf=#012#025#003#003 <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS accept:error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">ERROR: <core> [tcp_read.c:1330]: tcp_read_req(): ERROR: tcp_read_req: error reading <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Maybe you can see some hint there that I don’t see?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Cheers, Francisco.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> Daniel-Constantin Mierla [mailto:miconda@gmail.com]
<br>
<b>Sent:</b> Wednesday, October 25, 2017 14:50<br>
<b>To:</b> Kamailio (SER) - Users Mailing List <sr-users@lists.kamailio.org>; Francisco Valentin Vinagrero <francisco.valentin.vinagrero@cern.ch><br>
<b>Subject:</b> Re: [SR-Users] Mutual TLS with Skype for Business 2015<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Hello,<span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 25.10.17 11:32, Francisco Valentin Vinagrero wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I’m trying to replace two old Audiocodes gateways (used to interconnect our Skype for Business infrastructure to the PSTN) with a new Kamailio cluster.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">I am having some trouble to get the TLS mutual authentication working with Kamailio. For the moment, I’m just trying to receive the incoming OPTIONS from SfB, but I get all the time certificate verification errors:<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS accept:error:14089086:SSL routines:ssl3_get_client_certificate:certificate verify failed<o:p></o:p></p>
<p class="MsoNormal">ERROR: <core> [tcp_read.c:1330]: tcp_read_req(): ERROR: tcp_read_req: error reading<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">My tls.cfg is quite simple, with the same config for client and server (and one single listen=tls:<my IP>:5061 in the Kamailio.cfg file)<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">[server:default]<o:p></o:p></p>
<p class="MsoNormal">method = TLSv1+<o:p></o:p></p>
<p class="MsoNormal">verify_certificate = yes<o:p></o:p></p>
<p class="MsoNormal">require_certificate = yes<o:p></o:p></p>
<p class="MsoNormal">private_key = /usr/local/etc/kamailio/tls/key_gw_sfb.pem <o:p>
</o:p></p>
<p class="MsoNormal">certificate = /usr/local/etc/kamailio/tls/cert_gw_sfb.pem # => This certificate’s Subject is the DNS alias for the cluster, with all the kamailios in the cluster as Subject Alternative Names<o:p></o:p></p>
<p class="MsoNormal">ca_list = /usr/local/etc/kamailio/tls/myca_and_sfbca.pem # => Kamailio and Skype for Business are signed by different CAs, so here I concatenated all intermediate and root CAs<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">[client:default]<o:p></o:p></p>
<p class="MsoNormal">method = TLSv1+<o:p></o:p></p>
<p class="MsoNormal">verify_certificate = yes<o:p></o:p></p>
<p class="MsoNormal">require_certificate = yes<o:p></o:p></p>
<p class="MsoNormal">private_key = /usr/local/etc/kamailio/tls/key_gw_sfb.pem<o:p></o:p></p>
<p class="MsoNormal"><span lang="FR">certificate = /usr/local/etc/kamailio/tls/cert_gw_sfb.pem</span><o:p></o:p></p>
<p class="MsoNormal">ca_list = /usr/local/etc/kamailio/tls/myca_and_sfbca.pem<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">When I run Kamailio, I can see incoming OPTIONS from Microsoft Exchange Unified Messaging (UM), whose certificate I verify without any issues. UM presents a certificate issued for a single machine, so no Subject Alternative Names (SANs)
are involved.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">The problem comes with the TLS handshake for the Skype Mediation pool. They have a certificate with Subject = DNS alias and all the physical machines that are behind the alias appear listed as Subject Alternative Names (SANs) in the certificate.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">As the only difference between UM and Skype’s Mediation is the certificate’s Subject, I think I am missing something on my configuration to validate the SANs instead of the subject. Is the TLS module doing any reverse DNS lookup to verify
this?<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">afaik, the certificate validation is done by the libssl, kamailio is not doing much in this respect and no dns query inside kamailio tls module. Maybe some parameters must
be set when asking for validation.<br>
<br>
If you run with debug=3 inside kamailio.cfg, do you see any log messages that can help in identifying why it fails?<br>
<br>
Cheers,<br>
Daniel<br>
<br>
<o:p></o:p></span></p>
<pre>-- <o:p></o:p></pre>
<pre>Daniel-Constantin Mierla<o:p></o:p></pre>
<pre><a href="http://www.twitter.com/miconda">www.twitter.com/miconda</a> -- <a href="http://www.linkedin.com/in/miconda">www.linkedin.com/in/miconda</a><o:p></o:p></pre>
<pre>Kamailio Advanced Training, Nov 13-15, 2017, in Berlin - <a href="http://www.asipto.com">www.asipto.com</a><o:p></o:p></pre>
<pre>Kamailio World Conference - <a href="http://www.kamailioworld.com">www.kamailioworld.com</a><o:p></o:p></pre>
</div>
</body>
</html>