<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div>
<div>
<div style="direction: ltr;">That’s how I have it. Although I’ve put the certs into kamailio folder.
<span id="ms-outlook-ios-cursor"></span></div>
</div>
<div><br>
</div>
<div class="ms-outlook-ios-signature">Get <a href="https://aka.ms/o0ukef">Outlook for iOS</a></div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> sr-users <sr-users-bounces@lists.kamailio.org> on behalf of Joel Serrano <joel@textplus.com><br>
<b>Sent:</b> Friday, November 20, 2020 6:51:04 PM<br>
<b>To:</b> Kamailio (SER) - Users Mailing List <sr-users@lists.kamailio.org><br>
<b>Subject:</b> Re: [SR-Users] Issue with ca-list</font>
<div> </div>
</div>
<div>
<div dir="auto">Hey George,</div>
<div dir="auto"><br>
</div>
<div dir="auto">I’m not on my computer right now, but give a try with your settings but changing:</div>
<div dir="auto"><br>
</div>
<div dir="auto">ca_list=/etc/ssl/certs/ca-certificates.crt</div>
<div dir="auto"><br>
</div>
<div dir="auto">(That is for Debian, other OS have different locations)</div>
<div dir="auto"><br>
</div>
<div dir="auto">Using that on Debian 10 it works, but be prepared to wait a while for the startup and potentially increasing memory limits..</div>
<div dir="auto"><br>
</div>
<div dir="auto"><br>
</div>
<div><br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Fri, Nov 20, 2020 at 10:43 George Goglidze <<a href="mailto:george@ipcorp.co.uk">george@ipcorp.co.uk</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-style:solid; padding-left:1ex; border-left-color:rgb(204,204,204)">
<div>
<div>
<div>
<div style="direction:ltr">I can narrow it down - as the team’s part only uses Baltimore certificates
</div>
<div><br>
</div>
<div style="direction:ltr">That actually means one root and 4 subordinates for direct routing currently.
</div>
<div><br>
</div>
<div style="direction:ltr">I can point out exact certs you need if you cannot identify them.
</div>
<div><br>
</div>
<div style="direction:ltr">But can you please share your configuration to make this work? As I was not able to.
</div>
<div><br>
</div>
<div style="direction:ltr">What’s your kaimailo.cfg/ tls.cfg like? <span id="x_m_-6008188573468650730ms-outlook-ios-cursor">
</span></div>
</div>
<div><br>
</div>
<div>Get <a href="https://aka.ms/o0ukef" target="_blank">Outlook for iOS</a></div>
</div>
<hr style="display:inline-block; width:98%">
<div id="x_m_-6008188573468650730divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt; font-family:Calibri,sans-serif; color:rgb(0,0,0)"><b style="font-family:Calibri,sans-serif">From:</b> sr-users <<a href="mailto:sr-users-bounces@lists.kamailio.org" target="_blank" style="font-family:Calibri,sans-serif">sr-users-bounces@lists.kamailio.org</a>>
on behalf of Joel Serrano <<a href="mailto:joel@textplus.com" target="_blank" style="font-family:Calibri,sans-serif">joel@textplus.com</a>><br>
<b style="font-family:Calibri,sans-serif">Sent:</b> Friday, November 20, 2020 6:30:17 PM</font></div>
</div>
<div>
<div id="x_m_-6008188573468650730divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt; font-family:Calibri,sans-serif; color:rgb(0,0,0)"><br>
<b style="font-family:Calibri,sans-serif">To:</b> Kamailio (SER) - Users Mailing List <<a href="mailto:sr-users@lists.kamailio.org" target="_blank" style="font-family:Calibri,sans-serif">sr-users@lists.kamailio.org</a>><br>
<b style="font-family:Calibri,sans-serif">Subject:</b> Re: [SR-Users] Issue with ca-list</font>
<div> </div>
</div>
<div>
<div dir="auto">I have that working using the OS provided ssl CA list. That said, Kamailio takes >20s to startup because it has to load the entire list, and I had to increase memory limits. </div>
<div dir="auto"><br>
</div>
<div dir="auto">If you manage to narrow the list down please share it.</div>
<div><br>
<div>
<div dir="ltr">On Fri, Nov 20, 2020 at 07:59 George Goglidze <<a href="mailto:george@ipcorp.co.uk" target="_blank">george@ipcorp.co.uk</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex; border-left-width:1px; border-left-style:solid; padding-left:1ex; border-left-color:rgb(204,204,204)">
<div lang="EN-GB" style="word-wrap:break-word">
<div>
<p><span style="font-size:11pt">To be exact this is what my ca_list file contains:
<u></u><u></u></span></p>
<p><span style="font-size:11pt">My own certificate’s root CA<u></u><u></u></span></p>
<p><span style="font-size:11pt">My own certificate’s subordinate CA<u></u><u></u></span></p>
<p><span style="font-size:11pt">Remote SIP Provider’s root CAs (there are many over 10)<u></u><u></u></span></p>
<p><span style="font-size:11pt">Remote SIP Provider’s subordinate CAs (over 50)<u></u><u></u></span></p>
<p><span style="font-size:11pt"><u></u> <u></u></span></p>
<p><span style="font-size:11pt">I’m trying Direct Routing integration with Microsoft – and there’s a big list of root CA’s and subordinates that Microsoft recommends you to trust for this purpose.
<u></u><u></u></span></p>
<p><span style="font-size:11pt">Here’s the link to all certificates:<u></u><u></u></span></p>
<p><span style="font-size:11pt"><a href="https://docs.microsoft.com/en-us/microsoft-365/compliance/encryption-office-365-certificate-chains?view=o365-worldwide" target="_blank">https://docs.microsoft.com/en-us/microsoft-365/compliance/encryption-office-365-certificate-chains?view=o365-worldwide</a><u></u><u></u></span></p>
<p><span style="font-size:11pt"><u></u> <u></u></span></p>
<p><span style="font-size:11pt">Regards,<u></u><u></u></span></p>
<p><span style="font-size:11pt"><u></u> <u></u></span></p>
<div style="border-style:solid none none; border-top-width:1pt; padding:3pt 0cm 0cm; border-top-color:rgb(181,196,223)">
<p style="margin-bottom:12pt"><b><span style="color:black">From: </span></b><span style="color:black">Daniel-Constantin Mierla <<a href="mailto:miconda@gmail.com" target="_blank">miconda@gmail.com</a>><br>
<b>Date: </b>Friday, 20 November 2020 at 15:48<br>
</span></p>
</div>
</div>
</div>
<div lang="EN-GB" style="word-wrap:break-word">
<div>
<div style="border-style:solid none none; border-top-width:1pt; padding:3pt 0cm 0cm; border-top-color:rgb(181,196,223)">
<p style="margin-bottom:12pt"><span style="color:black"><b>To: </b>George Goglidze <<a href="mailto:george@ipcorp.co.uk" target="_blank">george@ipcorp.co.uk</a>>, Kamailio (SER) - Users Mailing List <<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a>><br>
<b>Subject: </b>Re: [SR-Users] Issue with ca-list</span></p>
</div>
</div>
</div>
<div lang="EN-GB" style="word-wrap:break-word">
<div>
<div style="border-style:solid none none; border-top-width:1pt; padding:3pt 0cm 0cm; border-top-color:rgb(181,196,223)">
<p style="margin-bottom:12pt"><span style="color:black"></span><span style="color:black"><u></u><u></u></span></p>
</div>
</div>
</div>
<div lang="EN-GB" style="word-wrap:break-word">
<div>
<p>Hello,<u></u><u></u></p>
<p>does the client section ca_list file has the CA of the remote server?<u></u><u></u></p>
<p>Cheers,<br>
Daniel<u></u><u></u></p>
<div>
<p>On 20.11.20 15:56, George Goglidze wrote:<u></u><u></u></p>
</div>
<blockquote style="margin-top:5pt; margin-bottom:5pt">
<p><span style="font-size:11pt">Hi Daniel,</span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">No – you misunderstood me. </span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">It’s not the remote server that is not trusting us but we are not trusting the remote server.</span><u></u><u></u></p>
<p><span style="font-size:11pt">My SBC (Kamailio) is sending out TLS error unknown CA.</span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">Thanks, </span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<div style="border-style:solid none none; border-top-width:1pt; padding:3pt 0cm 0cm; border-top-color:rgb(181,196,223)">
<p style="margin-bottom:12pt"><b><span style="color:black">From: </span></b><span style="color:black">Daniel-Constantin Mierla
<a href="mailto:miconda@gmail.com" target="_blank"><miconda@gmail.com></a><br>
<b>Date: </b>Friday, 20 November 2020 at 14:48<br>
<b>To: </b>Kamailio (SER) - Users Mailing List <a href="mailto:sr-users@lists.kamailio.org" target="_blank">
<sr-users@lists.kamailio.org></a>, George Goglidze <a href="mailto:george@ipcorp.co.uk" target="_blank">
<george@ipcorp.co.uk></a><br>
<b>Subject: </b>Re: [SR-Users] Issue with ca-list</span><u></u><u></u></p>
</div>
<p>Hello,<u></u><u></u></p>
<div>
<p>On 20.11.20 11:13, George Goglidze wrote:<u></u><u></u></p>
</div>
<blockquote style="margin-top:5pt; margin-bottom:5pt">
<p><span style="font-size:11pt">Hi Folks,</span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">I was wondering if somebody could help me with an issue. I’m a newbie here, just installing Kamailio sip server.</span><u></u><u></u></p>
<p><span style="font-size:11pt">I’ve enabled TLS, and am trying create a SIP Trunk to external SIP Service which is TLS enabled port 5061.
</span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">I’ve configured the following in tls.cfg:</span><u></u><u></u></p>
<p><span>[server:default]</span><u></u><u></u></p>
<p><span>method = TLSv1.2+</span><u></u><u></u></p>
<p><span>verify_certificate = yes</span><u></u><u></u></p>
<p><span>require_certificate = yes</span><u></u><u></u></p>
<p><span>private_key = /etc/kamailio/certs/sbc-private.pem</span><u></u><u></u></p>
<p><span>certificate = /etc/kamailio/certs/godaddy.pem</span><u></u><u></u></p>
<p><span>ca_list = /etc/kamailio/certs/calist.pem</span><span> </span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">In the section above – ca_list = calist.pem contains all the CA’s and Subordinates of the destination server.
</span><u></u><u></u></p>
<p><span style="font-size:11pt">Private_key and certificate are of my own server (public godaddy<span style="color:rgb(112,173,71)">
</span>signed) </span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span>[client:default]</span><u></u><u></u></p>
<p><span>method = TLSv1.2+</span><u></u><u></u></p>
<p><span>verify_certificate = yes</span><u></u><u></u></p>
<p><span>require_certificate = yes</span><u></u><u></u></p>
<p><span>private_key = /etc/kamailio/certs/sbc-private.pem</span><u></u><u></u></p>
<p><span>certificate = /etc/kamailio/certs/godaddy.pem</span><u></u><u></u></p>
<p><span>ca_list = /etc/kamailio/certs/godaddyca.pem</span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">In the section above the ca_list is godaddy’s ca and subordinate.</span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">In the wireshark I can see that I’m sending out SIP OPTIONS PING (I’m using dispatcher module).
</span><u></u><u></u></p>
<p><span style="font-size:11pt">Then the server replies with tls SERVER HELLO which includes it’s certificate</span><u></u><u></u></p>
<p><span style="font-size:11pt">But for some reason we are rejecting it:</span><u></u><u></u></p>
<p><span style="font-size:11pt">Alert (level: fatal, Description: Unknown CA)</span><u></u><u></u></p>
<p><span style="font-size:11pt"> </span><u></u><u></u></p>
<p><span style="font-size:11pt">How should I set this up to make sure the remote server CA’s are verified?
</span><u></u><u></u></p>
</blockquote>
<p> <u></u><u></u></p>
<p>I am not sure I understand what you want to do -- to verify that the list of CAs trusted by the remote server? This is not possible, what is trusted by the server is its own business. An entity can verify only of the presented certificate by a peer is signed
by a trusted CA from its CAs trusted list.<u></u><u></u></p>
<p>Cheers,<br>
Daniel<u></u><u></u></p>
<pre style="font-family:monospace">-- <u style="font-family:monospace"></u><u style="font-family:monospace"></u></pre>
<pre style="font-family:monospace">Daniel-Constantin Mierla -- <a href="http://www.asipto.com" target="_blank" style="font-family:monospace">www.asipto.com</a><u style="font-family:monospace"></u><u style="font-family:monospace"></u></pre>
<pre style="font-family:monospace"><a href="http://www.twitter.com/miconda" target="_blank" style="font-family:monospace">www.twitter.com/miconda</a> -- <a href="http://www.linkedin.com/in/miconda" target="_blank" style="font-family:monospace">www.linkedin.com/in/miconda</a><u style="font-family:monospace"></u><u style="font-family:monospace"></u></pre>
<pre style="font-family:monospace">Funding: <a href="https://www.paypal.me/dcmierla" target="_blank" style="font-family:monospace">https://www.paypal.me/dcmierla</a><u style="font-family:monospace"></u><u style="font-family:monospace"></u></pre>
<p><span style="font-size:11pt">--></span><u></u><u></u></p>
</blockquote>
<pre style="font-family:monospace">-- <u style="font-family:monospace"></u><u style="font-family:monospace"></u></pre>
<pre style="font-family:monospace">Daniel-Constantin Mierla -- <a href="http://www.asipto.com" target="_blank" style="font-family:monospace">www.asipto.com</a><u style="font-family:monospace"></u><u style="font-family:monospace"></u></pre>
<pre style="font-family:monospace"><a href="http://www.twitter.com/miconda" target="_blank" style="font-family:monospace">www.twitter.com/miconda</a> -- <a href="http://www.linkedin.com/in/miconda" target="_blank" style="font-family:monospace">www.linkedin.com/in/miconda</a><u style="font-family:monospace"></u><u style="font-family:monospace"></u></pre>
<pre style="font-family:monospace">Funding: <a href="https://www.paypal.me/dcmierla" target="_blank" style="font-family:monospace">https://www.paypal.me/dcmierla</a><u style="font-family:monospace"></u><u style="font-family:monospace"></u></pre>
</div>
</div>
<div lang="EN-GB" style="word-wrap:break-word">
<div>
<p><span style="font-size:11pt">--><u></u><u></u></span></p>
</div>
</div>
_______________________________________________<br>
Kamailio (SER) - Users Mailing List<br>
<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
<a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Kamailio (SER) - Users Mailing List<br>
<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><br>
<a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" rel="noreferrer" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><br>
</blockquote>
</div>
</div>
</div>
</body>
</html>