Hello,

can you try with debug=3 in kamailio.cfg, there should be more logs that can provide hints on what happens.

Also, what are your settings for tls module? Do you require a specific TLS version?

Cheers,
Daniel

Hi Guys,

I am trying to setup the following flow:

Browser >> WSS >> HA Proxy >>> WSS >> Kamailio

But getting TLS errors in Kamailio logs:

[29634]: ERROR: <core> [tcp_read.c:1321]: tcp_read_req(): ERROR: tcp_read_req: error reading - c: 0x7f68ebe872b0 r: 0x7f68ebe87330

[29631]: ERROR: tls [tls_util.h:42]: tls_err_ret(): TLS accept:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

Browser <-----wss---->Kamailio  works fine with same certs. 

Both HA Proxy and Kamilio are installed on separate servers, hosting on same port with different domain. Kamailio tls.conf has method = TLSv1

@HA Proxy:

openssl s_client -connect HA-PROXY-DOMAIN:10443

SSL-Session:

    Protocol  : TLSv1.2

@Kamailio :

openssl s_client -connect KAMAILIO-DOMAIN:10443

SSL-Session:

    Protocol  : TLSv1

So I made HA Proxy to be on TLSv1 "ssl-default-bind-options force-tlsv10" But still I get the same TLS error in Kamailio. 

HA Proxy config looks like:

frontend public

  bind *:10443 ssl crt /etc/haproxy/certs/cert.pem

  acl is_websocket hdr_end(host) -i m1.some-domain.com

  use_backend wss if is_websocket

  default_backend wss

backend wss

  timeout server 600s

  server ws1 k1.some-domain.com:10443

  server ws1 k2.some-domain.com:10443

Need some direction, thanks in advance.

Regards,

Jade

_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users@lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

-- 
Daniel-Constantin Mierla
www.twitter.com/miconda -- www.linkedin.com/in/miconda
Kamailio Advanced Training - Mar 6-8 (Europe) and Mar 20-22 (USA) - www.asipto.com
Kamailio World Conference - May 8-10, 2017 - www.kamailioworld.com