<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi all<div class=""><br class=""></div><div class="">Been trying to grab the TLS cert details from incoming connections, but failing :-(</div><div class=""><br class=""></div><div class="">So with lines just before AUTH is called like this;</div><div class=""><br class=""></div><div class=""><div class=""> if (proto == TLS) {</div><div class=""> xlog("L_INFO", "TLSDUMP $ci peer_subject : $tls_peer_subject\n");</div></div><div class=""><br class=""></div><div class="">Gets met with a log line line this;</div><div class=""><br class=""></div><div class="">INFO: tls [tls_server.c:431]: tls_accept(): tls_accept: new connection from 1.2.3.4:11797 using TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256</div><div class="">INFO: tls [tls_server.c:434]: tls_accept(): tls_accept: local socket: 5.6.7.8:5061</div><div class="">INFO: tls [tls_server.c:445]: tls_accept(): tls_accept: client did not present a certificate</div><div class="">...</div><div class="">INFO: tls [tls_select.c:168]: get_cert(): Unable to retrieve peer TLS certificate from SSL structure</div><div class=""><br class=""></div><div class="">This is with verify_certificate and require_certificate set to no in tls.cfg</div><div class=""><br class=""></div><div class="">If I try and set the following in tls.cfg</div><div class=""><br class=""></div><div class=""><div class="">[server:default]</div><div class="">method = TLSv1.2+</div><div class="">verify_certificate = no</div><div class="">require_certificate = yes</div><div class=""><br class=""></div><div class="">I see in the logs;</div><div class=""><br class=""></div><div class=""><div class="">INFO: tls [tls_domain.c:303]: ksr_tls_fill_missing(): TLSs<default>: tls_method=22</div><div class="">INFO: tls [tls_domain.c:315]: ksr_tls_fill_missing(): TLSs<default>: certificate='/etc/kamailio/tls-certs/cert.pem'</div><div class="">INFO: tls [tls_domain.c:322]: ksr_tls_fill_missing(): TLSs<default>: ca_list='(null)'</div><div class="">INFO: tls [tls_domain.c:329]: ksr_tls_fill_missing(): TLSs<default>: crl='(null)'</div><div class="">INFO: tls [tls_domain.c:333]: ksr_tls_fill_missing(): TLSs<default>: <b class="">require_certificate=1</b></div><div class="">INFO: tls [tls_domain.c:340]: ksr_tls_fill_missing(): TLSs<default>: cipher_list='(null)'</div><div class="">INFO: tls [tls_domain.c:347]: ksr_tls_fill_missing(): TLSs<default>: private_key='/etc/kamailio/tls-certs/privkey.pem'</div><div class="">INFO: tls [tls_domain.c:351]: ksr_tls_fill_missing(): TLSs<default>: <b class="">verify_certificate=0</b></div><div class="">INFO: tls [tls_domain.c:354]: ksr_tls_fill_missing(): TLSs<default>: verify_depth=9</div><div class="">NOTICE: tls [tls_domain.c:1095]: ksr_tls_fix_domain(): registered server_name callback handler for socket [:0], server_name='<default>' ...</div><div class="">INFO: tls [tls_domain.c:692]: set_verification(): TLSs<default>:<b class=""> Client MUST present valid certificate</b></div><div class="">INFO: tls [tls_domain.c:303]: ksr_tls_fill_missing(): TLSc<default>: tls_method=20</div><div class="">INFO: tls [tls_domain.c:315]: ksr_tls_fill_missing(): TLSc<default>: certificate='(null)'</div><div class="">INFO: tls [tls_domain.c:322]: ksr_tls_fill_missing(): TLSc<default>: ca_list='(null)'</div><div class="">INFO: tls [tls_domain.c:329]: ksr_tls_fill_missing(): TLSc<default>: crl='(null)'</div><div class="">INFO: tls [tls_domain.c:333]: ksr_tls_fill_missing(): TLSc<default>: <b class="">require_certificate=1</b></div><div class="">INFO: tls [tls_domain.c:340]: ksr_tls_fill_missing(): TLSc<default>: cipher_list='(null)'</div><div class="">INFO: tls [tls_domain.c:347]: ksr_tls_fill_missing(): TLSc<default>: private_key='(null)'</div><div class="">INFO: tls [tls_domain.c:351]: ksr_tls_fill_missing(): TLSc<default>: <b class="">verify_certificate=1</b></div><div class="">INFO: tls [tls_domain.c:354]: ksr_tls_fill_missing(): TLSc<default>: verify_depth=9</div><div class="">INFO: tls [tls_domain.c:692]: set_verification(): TLSc<default>: <b class="">Server MUST present valid certificate</b></div><div class="">...</div><div class="">ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS accept:error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed</div></div><div class=""><br class=""></div><div class="">Which looks like verification is being enabled when I add require?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Would someone be kind enough to point out what I am missing please? (Assuming it’s not a bug :-)</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">
Thanks<br class="">Mark<br class="">-- <br class="">Mark Boyce<br class="">Dark Origins Ltd</div></div></body></html>