Hi Alexander,<br>
<br>
Verification of the cert in openser for now is limited ... it checks
that the cert provided by the peer is signed by one of your trusted
roots. <br>
Thus, if one of the CAs you trust signs a certificate for <a href="http://sip.badguy.com">sip.badguy.com</a> ... you eat that certficate raw :)<br>
<br>
Obviously, this is no good. The discussions we are having though are shedding a lot of light. A summary ...<br>-
Provide flexibility in the way the connection is authenticated (what to
check from the sip message against what in the tls cert)<br>
- Support naptr look ups for flexible routing to tls and for sips uris<br>
- easy configuration of domains (when dialing in and out), with
different certs and setups. This is targeted at multi-domain providers<br>
<br>
Quite some work, but i am for it :)<br>
<br>
Cesc<br><br><div><span class="gmail_quote">On 10/10/05, <b class="gmail_sendername">Alexander Ph. Lintenhofer</b> <<a href="mailto:lintenhofer@aon.at">lintenhofer@aon.at</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Hi everybody,<br><br>According to RFC3261 proxies should possess a site certificate whose<br>subject corresponds to their canonical hostname.<br>In the case of gen_usercert.sh helperscript this must be placed in the<br>"Common Name" field I guess.
<br>So when mutual authentication takes place, the two proxies should check<br>the CN of each others certificate.<br><br>I have a proxy <a href="http://sip.atlanta.com">sip.atlanta.com</a> and another one <a href="http://sip.biloxi.com">
sip.biloxi.com</a>. I<br>generated two certificates with CN=hostname. Then I added the<br>rootCA-certs of the other proxy to the calist.pem. It works really fine :-)<br>So I played around and generated certificates with other CNs like
<br><a href="http://badguy.atlanta.com">badguy.atlanta.com</a> or <a href="http://sip.badname.com">sip.badname.com</a> or <a href="http://badguy.badname.com">badguy.badname.com</a> - they don't<br>have either the corresponding hostname or the domainname of the server
<br>(or both). I imported one after the other in <a href="http://sip.atlanta.com">sip.atlanta.com</a> - and it<br>still works (tls_init: verify_callback: preverify is good: verify<br>return: 1) :-(<br><br>So, am I doing something wrong or does OpenSER not validate the
<br>host/domainname of the server against the certificate's subject ???<br><br>Thanks for hints !<br><br>regards,<br>Philipp<br><br>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@openser.org">
Users@openser.org</a><br><a href="http://openser.org/cgi-bin/mailman/listinfo/users">http://openser.org/cgi-bin/mailman/listinfo/users</a><br></blockquote></div><br>