Hi!
Yesterday I tested the TLS module and noticed a few things:
- Kamailio compiled on OS/X refuse to connect to a kamailio server running a CAcert class 3 certificate. So does Counterpath Bria and Blink. I need to figure out the difference between their class 1 and class3 certs, unless someone here already knows.
- Even though verification is turned off (default) Kamailio refuses to use the self-signed cert created by the install unless you have the selfsigned cert in the ca-list pem file. This is propably a bug.
- If you only want to use Kamailio as a TLS client, connecting to other servers you have to add a listen port and a server certificate. Always. This is propably the design. To set up a connection, we base it on an existing listen port. If that doesn't exist, Kamailio refuse to connect.
- I can't find any way to check the server certificate for the server we connect to in the routing script. I guess the ONSEND route runs after we've selected server and transport, but before we're actually connected (in first transaction). The TLS module selects claim we have no TLS transport, even though ONSEND claims we have TLS transport... The tls.peer selects seems to be designed for inbound connections, not outbound.
This is not yet a bug report, just notes for comments and for the archives :-)
/O
I need to figure out the difference between their class 1 and class3 certs, unless someone here already knows.
They have some info at:
http://wiki.cacert.org/FAQ/TechnicalQuestions
Also, the signature algorithms differ; the older class1 uses RSA-MD5 whereas the newer class3 uses RSA-SHA256.
Sha2-256 might be the issue you hit.
-JimC
3 feb 2013 kl. 03:59 skrev James Cloos cloos@jhcloos.com:
I need to figure out the difference between their class 1 and class3 certs, unless someone here already knows.
They have some info at:
http://wiki.cacert.org/FAQ/TechnicalQuestions
Also, the signature algorithms differ; the older class1 uses RSA-MD5 whereas the newer class3 uses RSA-SHA256.
Sha2-256 might be the issue you hit.
Thanks for the feedback! I guess we need to test a bit more and then file bug reports.
/O
On 28.01.2013 08:58, Olle E. Johansson wrote:
- If you only want to use Kamailio as a TLS client, connecting to other servers you have to add a listen port and a server certificate. Always. This is propably the design. To set up a connection, we base it on an existing listen port. If that doesn't exist, Kamailio refuse to connect.
I think unless Kamailio is also a SIP Outbound client, it doesn't make sense to have a TLS-client-only mode for Kamailio.
regards Klaus
-
James Cloos -
Klaus Darilion -
Olle E. Johansson