<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:"Consolas",serif;}
span.E-MailFormatvorlage21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">there are some user agents that are logging errors (like pjsip) for wild card certificates or even not supporting it. But several major operators using it, so it works good with Kamailio,
of course.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Henning<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">-- <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Henning Westerholt –
</span><span style="mso-fareast-language:EN-US"><a href="https://skalatan.de/blog/"><span lang="EN-GB" style="color:#0563C1">https://skalatan.de/blog/</span></a></span><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Kamailio services –
</span><span style="mso-fareast-language:EN-US"><a href="https://gilawa.com/"><span lang="EN-GB" style="color:#0563C1">https://gilawa.com</span></a></span><span style="mso-fareast-language:EN-US">
<span lang="EN-GB"><o:p></o:p></span></span></p>
</div>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:35.4pt"><b>From:</b> sr-users <sr-users-bounces@lists.kamailio.org>
<b>On Behalf Of </b>Daniel-Constantin Mierla<br>
<b>Sent:</b> Friday, August 7, 2020 10:08 AM<br>
<b>To:</b> Kamailio (SER) - Users Mailing List <sr-users@lists.kamailio.org>; Leonid Fainshtein <leonid.fainshtein@xorcom.com><br>
<b>Subject:</b> Re: [SR-Users] Using wildcard certificates for Kamailio server<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
<p style="margin-left:35.4pt">Hello,<o:p></o:p></p>
<p style="margin-left:35.4pt">I was not aware of this constraint and I used wildcard certificates so far with Kamailio and all was ok.<o:p></o:p></p>
<p style="margin-left:35.4pt">If you want to be strict on this RFC, then you can do additional checks in the config file, because the validation of tls certificate is performed by libssl and it returns ok for wildcard certificates. There might be options for
libssl to disable wildcard matching, but I haven't looked for.<o:p></o:p></p>
<p style="margin-left:35.4pt">Cheers,<br>
Daniel<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">On 06.08.20 14:37, Leonid Fainshtein wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif">Hello,<br clear="all">
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif">Is it permitted to use the wildcard TLS certificates for Kamailio server?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif">In reality, it works (tested with v.5.4) but the RFC-5922 disables the wildcard certificates usage:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif">"Implementations MUST match the values in their entirety:<o:p></o:p></span></p>
</div>
<pre style="margin-left:35.4pt"> Implementations MUST NOT match suffixes. For example,<o:p></o:p></pre>
<pre style="margin-left:35.4pt"> "<a href="http://foo.example.com">foo.example.com</a>" does not match "<a href="http://example.com">example.com</a>".<o:p></o:p></pre>
<pre style="margin-left:35.4pt"><o:p> </o:p></pre>
<pre style="margin-left:35.4pt"> Implementations MUST NOT match any form of wildcard, such as a<o:p></o:p></pre>
<pre style="margin-left:35.4pt"> leading "." or "*." with any other DNS label or sequence of<o:p></o:p></pre>
<pre style="margin-left:35.4pt"> labels. For example, "*.<a href="http://example.com">example.com</a>" matches only<o:p></o:p></pre>
<pre style="margin-left:35.4pt"> "*.<a href="http://example.com">example.com</a>" but not "<a href="http://foo.example.com">foo.example.com</a>". Similarly,<o:p></o:p></pre>
<pre style="margin-left:35.4pt"> ".<a href="http://example.com">example.com</a>" matches only ".<a href="http://example.com">example.com</a>", and does not match<o:p></o:p></pre>
<pre style="margin-left:35.4pt"> "<a href="http://foo.example.com">foo.example.com</a>".<o:p></o:p></pre>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif">(Ref.:<a href="https://tools.ietf.org/html/rfc5922#section-7.2">https://tools.ietf.org/html/rfc5922#section-7.2</a>)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif">To be honest, I don't understand why this restriction is good for...<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif">Is somebody aware of a newer RFC that removes this limitation?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:35.4pt">
Best regards,<br>
Leonid Fainshtein<o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><br>
<br>
<o:p></o:p></p>
<pre style="margin-left:35.4pt">_______________________________________________<o:p></o:p></pre>
<pre style="margin-left:35.4pt">Kamailio (SER) - Users Mailing List<o:p></o:p></pre>
<pre style="margin-left:35.4pt"><a href="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a><o:p></o:p></pre>
<pre style="margin-left:35.4pt"><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><o:p></o:p></pre>
</blockquote>
<pre style="margin-left:35.4pt">-- <o:p></o:p></pre>
<pre style="margin-left:35.4pt">Daniel-Constantin Mierla -- <a href="http://www.asipto.com">www.asipto.com</a><o:p></o:p></pre>
<pre style="margin-left:35.4pt"><a href="http://www.twitter.com/miconda">www.twitter.com/miconda</a> -- <a href="http://www.linkedin.com/in/miconda">www.linkedin.com/in/miconda</a><o:p></o:p></pre>
<pre style="margin-left:35.4pt">Funding: <a href="https://www.paypal.me/dcmierla">https://www.paypal.me/dcmierla</a><o:p></o:p></pre>
</div>
</body>
</html>