Hi, I will need to take a look at this next week after my holidays. We actually tested security features using freeswitch but never did with asterisk as it is a new feature in 1.8.
Does the TLS negotiation succeed or does the 503 occurs since the TLS handshake fails? You can verify this using wireshark and filtering for SSL messages. Alexandre ----- Original Message ----- From: "Ana Gomez Muro" <[email protected]> To: "Alexandre Savard" <[email protected]> Cc: [email protected], [email protected] Sent: Monday, February 14, 2011 4:04:13 AM Subject: Re: [SFLphone] [Technical] sflphone and SIP with TLS Hi Alexandre, This is the negotation between asterisk and 2 different sflphone users. <info> Manager: Retrieve active codecs: <info> Account: Adding codec with RTP payload=0 <debug> SipAccount: Init TLS configuration <debug> Account: Set codec order from configuration file <info> Manager: Retrieve active codecs: <info> Account: Adding codec with RTP payload=0 <info> Account: Adding codec with RTP payload=3 <info> Account: Adding codec with RTP payload=8 <info> Account: Adding codec with RTP payload=9 <info> Account: Adding codec with RTP payload=110 <info> Account: Adding codec with RTP payload=111 <info> Account: Adding codec with RTP payload=112 <info> Account: Adding codec with RTP payload=115 <debug> Account: Register account Account:12 <debug> SipAccount: Init credential <debug> Account: TLS is ennabled for accounr Account:12 <debug> SipAccount: Init TLS configuration <debug> Manager: Found account Account:12 <debug> Manager: Found account Account:12 <debug> Manager: Found account Account:12 <debug> Create TLS listener <debug> Manager: Found account Account:12 <debug> UserAgent: Checking network, local IP address: IP_sflphone <debug> UserAgent: TLS transport to be initialized with published address IP_sflphone, published port 5061, local address , local port 5061 <debug> Create TLS transport for account Account:12 <debug> Manager: Found account Account:12 <debug> Acquire transport in account registration: tlsc0x2090468 TLS to IP_server:5061 (refcnt=1) <debug> Account: set registration state <debug> Manager: connectionStatusNotification <debug> SIP: Find local address from URI <debug> SIP: Local address discovered from attached transport: IP_sflphone <debug> UserAgent: local port discovered from attached transport: 5061 <debug> Display Name: <debug> UserAgent: sendRegister: fromUri: <sips:user_1@IP_server;transport=TLS> serverUri: <sips:IP_server;transport=TLS> contactUri: <sips:user_1@IP_sflphone:5061;transport=TLS> <debug> UserAgent: setting 1 credentials in sendRegister <debug> Manager: Found account Account:12 <debug> UserAgent: After setting the transport in account registration using transport: tlsc0x2090468 TLS to IP_server:5061 (refcnt=1) <debug> Sent account registration using transport: tlsc0x2090468 TLS to IP_server:5061 (refcnt=3) <debug> SipAccount: Init TLS configuration <debug> Account: Set codec order from configuration file <info> Manager: Retrieve active codecs: <info> Account: Adding codec with RTP payload=0 <debug> Account: Register account Account:13 <debug> SipAccount: Init credential <debug> Account: TLS is ennabled for accounr Account:13 <debug> SipAccount: Init TLS configuration <debug> Manager: Found account Account:13 <debug> Manager: Found account Account:13 <debug> Manager: Found account Account:13 <debug> Create TLS transport for account Account:13 <debug> Manager: Found account Account:13 <debug> Acquire transport in account registration: tlsc0x2090468 TLS to IP_server:5061 (refcnt=4) <debug> Account: set registration state <debug> Manager: connectionStatusNotification <debug> SIP: Find local address from URI <debug> SIP: Local address discovered from attached transport: IP_sflphone <debug> UserAgent: local port discovered from attached transport: 5061 <debug> Display Name: <debug> UserAgent: sendRegister: fromUri: <sips:user_2@IP_server;transport=TLS> serverUri: <sips:IP_server;transport=TLS> contactUri: <sips:user_2@IP_sflphone:5061;transport=TLS> <debug> UserAgent: setting 1 credentials in sendRegister <debug> Manager: Found account Account:13 <debug> UserAgent: After setting the transport in account registration using transport: tlsc0x2090468 TLS to IP_server:5061 (refcnt=4) <debug> Sent account registration using transport: tlsc0x2090468 TLS to IP_server:5061 (refcnt=6) <debug> Account: Set codec order from configuration file <info> Manager: Retrieve active codecs: <info> Account: Adding codec with RTP payload=0 <debug> Account: Register account IP2IP <debug> UserAgent: The error is: 503 <debug> Account: set registration state <debug> Manager: connectionStatusNotification <debug> UserAgent: Shutdown Sip Transport <debug> Manager: Found account Account:12 <debug> Transport bound to account, decrease ref count <debug> UserAgent: The error is: 503 <debug> Account: set registration state <debug> Manager: connectionStatusNotification <debug> UserAgent: Shutdown Sip Transport Thanks for answering! > Hi, > > Does SFLphone's TLS transport is initialized successfully? > > Use > > /usr/lib/sflphoned -d -c > > To access logs. > > Is there any SSL negotiation between SFLphone and Asterisk. > > Alexandre > > ----- Original Message ----- > From: [email protected] > To: [email protected] > Sent: Friday, February 11, 2011 4:03:17 AM > Subject: [SFLphone] [Technical] sflphone and SIP with TLS > > a sent a message using the contact form at > http://www.sflphone.org/contact. > > Hi, > > I'm trying to configure Asterisk 1.8 with SIPS and SRTP and I'm using > sflphone 0.9.12. > > I've created my own Certificate Authority and my Server Certificate: > -cacert.pem (Certificate Authority (CA)) > -server.pem (The server’s certificate file. It includes the key and the > certificate.) > > After the installation, the asterisk console shows: > 'SSL certificate ok' > and I realize that, really, asterisk is listening on port 5061. > > When I connect a client sflphone, I see in the tab "Accounts Configured" > softphone, the 'STATE' instead of showing that the user is > 'registered'appears as 'Invalid. The server returned "Service > Unavailable(503)"'. > > I've been searching for the security settings of the sflphone and I only > found the "Manual SFLphone v1.0" in which the srtp configuration is > specified > but not the sip with tls configuration. > > The settings made on the softphone are: > > > tls: > calist: /home/.../cacert.pem > certificate: > ciphers: > enable: true > method: TLSv1 > password: > privateKey: > requireCertif: true > server: IP_server:5061 > timeout: 2 > tlsPort: 5061 > verifyClient: true > verifyServer: true > > > > I hope somebody can help me. > > Thank you!!! > > > _______________________________________________ > SFLphone mailing list > [email protected] > http://lists.savoirfairelinux.net/mailman/listinfo/sflphone > _______________________________________________ > SFLphone mailing list > [email protected] > http://lists.savoirfairelinux.net/mailman/listinfo/sflphone > _______________________________________________ SFLphone mailing list [email protected] http://lists.savoirfairelinux.net/mailman/listinfo/sflphone
