20 Sep
2011
20 Sep
'11
4:51 a.m.
Hello,
On 9/19/11 5:54 PM, tomsc wrote:
Hi everyone,
I'd like to check that a client certificat is revoked or not against a crl.
Actually, opensips use context SSL_CTX. How can I do with this context?
I do this change to load the crl :
load_crl(SSL_CTX * ctx, char *filename)
{
LM_DBG("entered load crl\n");
X509_STORE *pStore = SSL_CTX_get_cert_store(ctx);
X509_LOOKUP* plookup = X509_STORE_add_lookup(pStore, X509_LOOKUP_file());
if (!X509_load_crl_file(plookup, filename, X509_FILETYPE_PEM)){
LM_ERR("unable to load certificate file '%s'\n",
filename);
return -1;
}
LM_DBG("'%s' successfuly loaded\n", filename);
return 0;
}
But I dont know how to add flags, is it the right solution?
first you sent the
message to the wrong mailing list. Here we discuss
about Kamailio (OpenSER) and SIP Express Router (SER).
Second, kamailio/ser has CRL support for long time. So you just need to
set the path to crl file to tls module parameter 'crl' in config file
and that's all you have to do:
http://kamailio.org/docs/modules/stable/modules/tls.html#crl
Part of next tutorial shows how to install tls in version 3.1.x for
debian distro, which is really simple:
http://kb.asipto.com/kamailio:skype-like-service-in-less-than-one-hour
It is not experimental TLS support like in other places, tls config file
can be reloaded at runtime without restart, see more in the readme of
the tls module:
http://kamailio.org/docs/modules/stable/modules/tls.html
The default config file of kamailio has also notes about TLS support --
very easy to enable by adding #!define WITH_TLS
Cheers,
Daniel
--
Daniel-Constantin Mierla -- http://www.asipto.com
Kamailio Advanced Training, Oct 10-13, Berlin: http://asipto.com/u/kat
http://linkedin.com/in/miconda -- http://twitter.com/miconda