How to get Stir/Shaken certificates - sr-users - kamailio.org

List overview All Threads
Download

How to get Stir/Shaken certificates

Kamailio/rtpengine not populating...

Question about MS Teams integration

ryan embgrets

22 Jul 2021 22 Jul '21

3:34 p.m.

Greetings. Does someone know where one can get stir/shaken certificates? Are they same as letsencrypt or do I need to obtain them from some other authority. If someone could provide me with a link to that authority it will be very helpful. Thanks again for your help and time. Ryan

Attachments:

attachment.html (text/html — 436 bytes)

Reply

Show replies by date

Oleg Belousov

22 Jul 22 Jul

4:16 p.m.

Hi. You need first to register with STI-PA (Policy Administrator), in order to receive a token to obtain further certificates from an approved Certification Authority. In the US STI-PA is Iconectiv, in Canada - Neustar. Please check that link https://authenticate.iconectiv.com/ -- obelousov.tel On Thu, Jul 22, 2021 at 3:38 PM ryan embgrets <rembgrets(a)gmail.com> wrote:

Greetings. Does someone know where one can get stir/shaken certificates? Are they same as letsencrypt or do I need to obtain them from some other authority. If someone could provide me with a link to that authority it will be very helpful. Thanks again for your help and time. Ryan __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions * sr-users(a)lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe: * https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

Reply

Benoît Panizzon

4:31 p.m.

Hi

You need first to register with STI-PA (Policy Administrator), in order to receive a token to obtain further certificates from an approved Certification Authority. In the US STI-PA is Iconectiv, in Canada - Neustar. Please check that link https://authenticate.iconectiv.com/

Thank you for that link. This is very interesting. We receive an increasing number of calls from spoofed US numbers in Switzerland. Mostly tech support scams. I was pondering if there is a way to validate them via STIR/SHAKEN. We try to filter out invalid +1 prefixes and lengths, but that is a rather fuzzy thing to do. So it would be great, if we could implement STIR/SHAKEN to validate received calls from the +1 prefix. Unfortunately to register for a STI-PA account, only TSP with an address in he United States are allowed. Do you know if there is a way to register as a Swiss Ofcom registered TSP? (And yes, I am aware that signature signalling also has to be implemented but we have to start somewhere). Hopefully STIR/SHAKEN can in future be deployed on a global level. Germany and UK would also benefit a lot, seeing also a lot of spoofed calls with their prefixes. -- Mit freundlichen Grüssen -Benoît Panizzon- @ HomeOffice und normal erreichbar -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

Reply

Oleg Belousov

4:46 p.m.

STIR-SHAKEN is currently only applicable for the US and Canada. To be part of it service provider must have an Operating Company Number (OCN) which allows access to NANPA Numbering Resource assignments. That also means (and as per my knowledge/experience) - US/Canadian SPs only sign calls with +1 destination. It is however worth it to check if the identity header is present in calls you receive. If it is here - then you can validate MT calls even not being part of a stir-shaken ecosystem. -- obelousov.tel On Thu, Jul 22, 2021 at 4:31 PM Benoît Panizzon <benoit.panizzon(a)imp.ch> wrote:

Hi

You need first to register with STI-PA (Policy Administrator), in order to receive a token to obtain further certificates from an approved Certification Authority. In the US STI-PA is Iconectiv, in Canada - Neustar. Please check that link https://authenticate.iconectiv.com/

Thank you for that link. This is very interesting. We receive an increasing number of calls from spoofed US numbers in Switzerland. Mostly tech support scams. I was pondering if there is a way to validate them via STIR/SHAKEN. We try to filter out invalid +1 prefixes and lengths, but that is a rather fuzzy thing to do. So it would be great, if we could implement STIR/SHAKEN to validate received calls from the +1 prefix. Unfortunately to register for a STI-PA account, only TSP with an address in he United States are allowed. Do you know if there is a way to register as a Swiss Ofcom registered TSP? (And yes, I am aware that signature signalling also has to be implemented but we have to start somewhere). Hopefully STIR/SHAKEN can in future be deployed on a global level. Germany and UK would also benefit a lot, seeing also a lot of spoofed calls with their prefixes. -- Mit freundlichen Grüssen -Benoît Panizzon- @ HomeOffice und normal erreichbar -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

Reply

David Villasmil

6:14 p.m.

There really is no way of doing what you’re thinking about. STIR/SHAKEN is really for calls TO US/Canada numbers. Where all incoming calls should have an Identity header which you can then validate. Even incoming international calls should in theory include said header as a transit (attestation C) source. You are receiving calls from US/Canada numbers to non-US/Canada numbers. You could, on the other hand, require your inbound providers to forward the identity header and you could then validate it, and act accordingly. Whether the providers will do that is another story. On Thu, 22 Jul 2021 at 16:52, Oleg Belousov <obelousov(a)gmail.com> wrote:

STIR-SHAKEN is currently only applicable for the US and Canada. To be part of it service provider must have an Operating Company Number (OCN) which allows access to NANPA Numbering Resource assignments. That also means (and as per my knowledge/experience) - US/Canadian SPs only sign calls with +1 destination. It is however worth it to check if the identity header is present in calls you receive. If it is here - then you can validate MT calls even not being part of a stir-shaken ecosystem. -- obelousov.tel On Thu, Jul 22, 2021 at 4:31 PM Benoît Panizzon <benoit.panizzon(a)imp.ch> wrote:

Hi

You need first to register with STI-PA (Policy Administrator), in order to receive a token to obtain further certificates from an approved Certification Authority. In the US STI-PA is Iconectiv, in Canada - Neustar. Please check that link https://authenticate.iconectiv.com/

Thank you for that link. This is very interesting. We receive an increasing number of calls from spoofed US numbers in Switzerland. Mostly tech support scams. I was pondering if there is a way to validate them via STIR/SHAKEN. We try to filter out invalid +1 prefixes and lengths, but that is a rather fuzzy thing to do. So it would be great, if we could implement STIR/SHAKEN to validate received calls from the +1 prefix. Unfortunately to register for a STI-PA account, only TSP with an address in he United States are allowed. Do you know if there is a way to register as a Swiss Ofcom registered TSP? (And yes, I am aware that signature signalling also has to be implemented but we have to start somewhere). Hopefully STIR/SHAKEN can in future be deployed on a global level. Germany and UK would also benefit a lot, seeing also a lot of spoofed calls with their prefixes. -- Mit freundlichen Grüssen -Benoît Panizzon- @ HomeOffice und normal erreichbar -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 <https://www.google.com/maps/search/Zurlindenstrasse+29?entry=gmail&source=g> Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

__________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions * sr-users(a)lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe: * https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- Regards, David Villasmil email: david.villasmil.work(a)gmail.com phone: +34669448337

Reply

David Villasmil

6:18 p.m.

I should say: “forward the header, or the validation result”, either should be enough. On Thu, 22 Jul 2021 at 18:14, David Villasmil < david.villasmil.work(a)gmail.com> wrote:

There really is no way of doing what you’re thinking about. STIR/SHAKEN is really for calls TO US/Canada numbers. Where all incoming calls should have an Identity header which you can then validate. Even incoming international calls should in theory include said header as a transit (attestation C) source. You are receiving calls from US/Canada numbers to non-US/Canada numbers. You could, on the other hand, require your inbound providers to forward the identity header and you could then validate it, and act accordingly. Whether the providers will do that is another story. On Thu, 22 Jul 2021 at 16:52, Oleg Belousov <obelousov(a)gmail.com> wrote:

STIR-SHAKEN is currently only applicable for the US and Canada. To be part of it service provider must have an Operating Company Number (OCN) which allows access to NANPA Numbering Resource assignments. That also means (and as per my knowledge/experience) - US/Canadian SPs only sign calls with +1 destination. It is however worth it to check if the identity header is present in calls you receive. If it is here - then you can validate MT calls even not being part of a stir-shaken ecosystem. -- obelousov.tel On Thu, Jul 22, 2021 at 4:31 PM Benoît Panizzon <benoit.panizzon(a)imp.ch> wrote:

Hi

You need first to register with STI-PA (Policy Administrator), in order to receive a token to obtain further certificates from an approved Certification Authority. In the US STI-PA is Iconectiv, in Canada - Neustar. Please check that link https://authenticate.iconectiv.com/

Thank you for that link. This is very interesting. We receive an increasing number of calls from spoofed US numbers in Switzerland. Mostly tech support scams. I was pondering if there is a way to validate them via STIR/SHAKEN. We try to filter out invalid +1 prefixes and lengths, but that is a rather fuzzy thing to do. So it would be great, if we could implement STIR/SHAKEN to validate received calls from the +1 prefix. Unfortunately to register for a STI-PA account, only TSP with an address in he United States are allowed. Do you know if there is a way to register as a Swiss Ofcom registered TSP? (And yes, I am aware that signature signalling also has to be implemented but we have to start somewhere). Hopefully STIR/SHAKEN can in future be deployed on a global level. Germany and UK would also benefit a lot, seeing also a lot of spoofed calls with their prefixes. -- Mit freundlichen Grüssen -Benoît Panizzon- @ HomeOffice und normal erreichbar -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 <https://www.google.com/maps/search/Zurlindenstrasse+29?entry=gmail&source=g> Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

__________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions * sr-users(a)lists.kamailio.org Important: keep the mailing list in the recipients, do not reply only to the sender! Edit mailing list options or unsubscribe: * https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users

-- Regards, David Villasmil email: david.villasmil.work(a)gmail.com phone: +34669448337

-- Regards, David Villasmil email: david.villasmil.work(a)gmail.com phone: +34669448337

Reply

1003

days inactive

1003

days old

sr-users@lists.kamailio.org

Manage subscription

5 comments

4 participants

tags (0)

participants (4)

Benoît Panizzon
David Villasmil
Oleg Belousov
ryan embgrets