Hi there,
I have set up a Kamailio 4.2.0 SIP server (centOS 7)
              for a university project regarding WebRTC comunication.
              While kamailio handles the signaling path I use the SIP.js
              demo phone js application (hosted on the same machine as
              kamaillio) for actual WebRTC stuff. 


For a deeper understanding and documetation
              purposes I have been trying to sniff the traffic with
              wireshark but failed due to the fact that kamailio uses
              Elliptic Curve Diffie Hellmann cipher suite (see wireshark
              snippet below) which is not decryptable.


Secure Sockets Layer


    TLSv1.2 Record Layer: Handshake Protocol:
              Server Hello


        Content Type: Handshake (22)


        Version: TLS 1.2 (0x0303)


        Length: 89


        Handshake Protocol: Server Hello


            Handshake Type: Server Hello (2)


            Length: 85


            Version: TLS 1.2 (0x0303)


            Random:
              b8916e4e0f7c712503a77afcf4c9228598092c166353be50...


            Session ID Length: 32


            Session ID:
              b0a31a6699a001b7991645dc61064ca4c4b073eff6913f26...


            Cipher Suite:
              TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)


            Compression Method: null (0)


            Extensions Length: 13


            Extension: renegotiation_info (len=1)


            Extension: ec_point_formats (len=4)
I already tried importing captured SSLKEYLOG pre master
              secret from chrome and private key file issued by
              letsencrypt without success.


On top of that I set this line 

            
    SSLCipherSuite
!DH:!ECDH:!EDH:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
              

in /etc/httpd/conf.d/ssl.conf and compiled openssl with
              no-ec no-dh (which worked see below).
[admin@kamailio-sip ~]$ openssl ciphers

SRP-DSS-AES-256-CBC-SHA:SRP-RSA-AES-256-CBC-SHA:SRP-AES-256-CBC-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:CAMELLIA256-SHA:PSK-AES256-CBC-SHA:SRP-DSS-AES-128-CBC-SHA:SRP-RSA-AES-128-CBC-SHA:SRP-AES-128-CBC-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:SEED-SHA:CAMELLIA128-SHA:IDEA-CBC-SHA:PSK-AES128-CBC-SHA:RC4-SHA:RC4-MD5:PSK-RC4-SHA:SRP-DSS-3DES-EDE-CBC-SHA:SRP-RSA-3DES-EDE-CBC-SHA:SRP-3DES-EDE-CBC-SHA:DES-CBC3-SHA:PSK-3DES-EDE-CBC-SHA

              [admin@kamailio-sip ~]$


Setting 

            
    modparam("tls", "cipher_list", "AESCCM") 

            
(or different ciphers) in /etc/kamailio/kamailio.cfg
              seems to have no effect on the actual negoiated cipher
              suite.

            
Am I missing something? Any help or pointers into the
              right direction will be much appreciated.
are you also using tls.cfg? If yes, there is an attribute
          for chiper list in it as well, try and see if works with it.

          
          Cheers,

          Daniel

        
-- 
Daniel-Constantin Mierla
www.twitter.com/miconda -- www.linkedin.com/in/miconda
Kamailio Advanced Training - www.asipto.com
Kamailio World Conference - May 14-16, 2018 - www.kamailioworld.com
_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users@lists.kamailio.org
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users