3 Oct
2012
3 Oct
'12
9:32 p.m.
Hi,
I have Kamailio 3.3.1 working fine with TLS 1.0, running on CentOS 6.3
However, now I want to use some ECDHE ciphersuites, for instance:
ECDHE-ECDSA-AES128-SHA
I have built an appropriate OpenSSL (1.0.0j) in CentOS to support this, and have generated
the appropriate certs:
openssl ecparam -out ca-privkey.pem -name secp256r1 -genkey -outform pem
openssl req -x509 -new -key ca-privkey.pem -out ca_cert.pem -outform PEM -days 3650
openssl ecparam -out privkey.pem -name secp256r1 -genkey -outform pem
openssl req -new -nodes -key privkey.pem -outform pem -out cert_req.pem
openssl ca -keyfile ca-privkey.pem -cert ca_cert.pem -in cert_req.pem -out cert.pem
However, when I try to connect from my phone I am always getting:
Oct 3 20:27:54 /usr/sbin/kamailio[2905]: ERROR: tls [tls_server.c:1190]: TLS
accept:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
Oct 3 20:27:54 /usr/sbin/kamailio[2905]: ERROR: <core> [tcp_read.c:1127]: ERROR:
tcp_read_req: error reading
If I use the OpenSSL s_server test-tool, I can connect from my phone just fine with these
certs:
openssl s_server -accept 8888 -cert cert.pem -key key.pem -pass stdin -CAfile calist.pem
-cipher ECDHE-ECDSA-AES128-SHA
Does Kamailio support ECDHE ciphersuites?
If so, what am I doing wrong?
Thanks!
AJ
5 Oct
5 Oct
4:23 a.m.
Hello,
it should support all the ciphers from the library. Anyhow, you can
force a list through module parameter:
http://kamailio.org/docs/modules/stable/modules/tls.html#cipher_list
Also, be sure you don't have many versions of the ssl lib installed, or
if yes, then be sure you link against the right one.
Cheers,
Daniel
On 10/4/12 3:32 AM, AJ wrote:
Hi,
I have Kamailio 3.3.1 working fine with TLS 1.0, running on CentOS 6.3
However, now I want to use some ECDHE ciphersuites, for instance:
ECDHE-ECDSA-AES128-SHA
I have built an appropriate OpenSSL (1.0.0j) in CentOS to support this, and have
generated the appropriate certs:
openssl ecparam -out ca-privkey.pem -name secp256r1 -genkey -outform pem
openssl req -x509 -new -key ca-privkey.pem -out ca_cert.pem -outform PEM -days 3650
openssl ecparam -out privkey.pem -name secp256r1 -genkey -outform pem
openssl req -new -nodes -key privkey.pem -outform pem -out cert_req.pem
openssl ca -keyfile ca-privkey.pem -cert ca_cert.pem -in cert_req.pem -out cert.pem
However, when I try to connect from my phone I am always getting:
Oct 3 20:27:54 /usr/sbin/kamailio[2905]: ERROR: tls [tls_server.c:1190]: TLS
accept:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
Oct 3 20:27:54 /usr/sbin/kamailio[2905]: ERROR: <core> [tcp_read.c:1127]: ERROR:
tcp_read_req: error reading
If I use the OpenSSL s_server test-tool, I can connect from my phone just fine with these
certs:
openssl s_server -accept 8888 -cert cert.pem -key key.pem -pass stdin -CAfile calist.pem
-cipher ECDHE-ECDSA-AES128-SHA
Does Kamailio support ECDHE ciphersuites?
If so, what am I doing wrong?
Thanks!
AJ
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users(a)lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
--
Daniel-Constantin Mierla - http://www.asipto.com
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Kamailio Advanced Training, Berlin, Nov 5-8, 2012 - http://asipto.com/u/kat
Kamailio Advanced Training, Miami, USA, Nov 12-14, 2012 - http://asipto.com/u/katu
5:17 a.m.
New subject: BAD request
Hi,
Can anybody help why 'BAD request' is sent for the Invite?
Thanks a lot
Amar
SeqNO: 22155, Time:2012-10-5 14:28:16, RECEIVED MSG FROM OTHERSS
Sender<-->Receiver:109.169.25.9:5060 <---> 103.10.31.251:5060
INVITE sip:9779841512112@103.10.31.251:5060 SIP/2.0
Max-Forwards: 69
From: "147963"
<sip:84473@sip58.dial2dayplus.us>;tag=T-mDbiFHTcemPwtrCSksCpvl0mJ8HaI5
To: <sip:9779841512112@103.10.31.251:5060>
Call-ID: gx.R3nZ.4.1-N4oFwOqQ1zQ0SAj8vseQ
CSeq: 29171 INVITE
Allow:
PRACK,INVITE,ACK,BYE,CANCEL,UPDATE,SUBSCRIBE,NOTIFY,REFER,MESSAGE,OPTIONS
Session-Expires: 1800
Min-SE: 90
P-hint: outbound
Supported: timer
Via: SIP/2.0/UDP 109.169.25.9:5060;branch=z9hG4bK1349426396705
Contact: <sip:109.169.25.9:5060>
Expires: 300
Record-Route: <sip:109.169.25.9;lr=on>
Content-Type: application/sdp
Content-Length: 233
v=0
o=- 3558415916 3558415916 IN IP4 42.108.33.29
s=pjmedia
c=IN IP4 195.219.14.151
t=0 0
m=audio 21556 RTP/AVP 18 101
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=sendrecv
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
SeqNO: 22156, Time:2012-10-5 14:28:16, SEND MSG TO OTHERSS
Sender<-->Receiver:103.10.31.251:5060 <---> 109.169.25.9:5060
SIP/2.0 400 Bad Request
Via: SIP/2.0/UDP 109.169.25.9:5060;branch=z9hG4bK1349426396705
CSeq: 29171 INVITE
From: "147963"
<sip:84473@sip58.dial2dayplus.us>;tag=T-mDbiFHTcemPwtrCSksCpvl0mJ8HaI5
To: <sip:9779841512112@103.10.31.251:5060>;tag=8
X-ZTE-Cause: "SBC-5442"
Call-ID: gx.R3nZ.4.1-N4oFwOqQ1zQ0SAj8vseQ
Content-Length: 0
4466
days inactive
4467
days old
2 comments
3 participants
participants (3)
-
AJ -
Amar Tuladhar -
Daniel-Constantin Mierla