Hey George, I’m not on my computer right now, but give a try with your settings but changing:
ca_list=/etc/ssl/certs/ca-certificates.crt (That is for Debian, other OS have different locations) Using that on Debian 10 it works, but be prepared to wait a while for the startup and potentially increasing memory limits.. On Fri, Nov 20, 2020 at 10:43 George Goglidze <[email protected]> wrote: > I can narrow it down - as the team’s part only uses Baltimore certificates > > That actually means one root and 4 subordinates for direct routing > currently. > > I can point out exact certs you need if you cannot identify them. > > But can you please share your configuration to make this work? As I was > not able to. > > What’s your kaimailo.cfg/ tls.cfg like? > > Get Outlook for iOS <https://aka.ms/o0ukef> > ------------------------------ > *From:* sr-users <[email protected]> on behalf of Joel > Serrano <[email protected]> > *Sent:* Friday, November 20, 2020 6:30:17 PM > > *To:* Kamailio (SER) - Users Mailing List <[email protected]> > *Subject:* Re: [SR-Users] Issue with ca-list > > I have that working using the OS provided ssl CA list. That said, Kamailio > takes >20s to startup because it has to load the entire list, and I had to > increase memory limits. > > If you manage to narrow the list down please share it. > > On Fri, Nov 20, 2020 at 07:59 George Goglidze <[email protected]> wrote: > > To be exact this is what my ca_list file contains: > > My own certificate’s root CA > > My own certificate’s subordinate CA > > Remote SIP Provider’s root CAs (there are many over 10) > > Remote SIP Provider’s subordinate CAs (over 50) > > > > I’m trying Direct Routing integration with Microsoft – and there’s a big > list of root CA’s and subordinates that Microsoft recommends you to trust > for this purpose. > > Here’s the link to all certificates: > > > https://docs.microsoft.com/en-us/microsoft-365/compliance/encryption-office-365-certificate-chains?view=o365-worldwide > > > > Regards, > > > > *From: *Daniel-Constantin Mierla <[email protected]> > *Date: *Friday, 20 November 2020 at 15:48 > > *To: *George Goglidze <[email protected]>, Kamailio (SER) - Users > Mailing List <[email protected]> > *Subject: *Re: [SR-Users] Issue with ca-list > > Hello, > > does the client section ca_list file has the CA of the remote server? > > Cheers, > Daniel > > On 20.11.20 15:56, George Goglidze wrote: > > Hi Daniel, > > > > No – you misunderstood me. > > > > It’s not the remote server that is not trusting us but we are not > trusting the remote server. > > My SBC (Kamailio) is sending out TLS error unknown CA. > > > > Thanks, > > > > *From: *Daniel-Constantin Mierla <[email protected]> <[email protected]> > *Date: *Friday, 20 November 2020 at 14:48 > *To: *Kamailio (SER) - Users Mailing List <[email protected]> > <[email protected]>, George Goglidze <[email protected]> > <[email protected]> > *Subject: *Re: [SR-Users] Issue with ca-list > > Hello, > > On 20.11.20 11:13, George Goglidze wrote: > > Hi Folks, > > > > I was wondering if somebody could help me with an issue. I’m a newbie > here, just installing Kamailio sip server. > > I’ve enabled TLS, and am trying create a SIP Trunk to external SIP Service > which is TLS enabled port 5061. > > > > I’ve configured the following in tls.cfg: > > [server:default] > > method = TLSv1.2+ > > verify_certificate = yes > > require_certificate = yes > > private_key = /etc/kamailio/certs/sbc-private.pem > > certificate = /etc/kamailio/certs/godaddy.pem > > ca_list = /etc/kamailio/certs/calist.pem > > > > In the section above – ca_list = calist.pem contains all the CA’s and > Subordinates of the destination server. > > Private_key and certificate are of my own server (public godaddy signed) > > > > [client:default] > > method = TLSv1.2+ > > verify_certificate = yes > > require_certificate = yes > > private_key = /etc/kamailio/certs/sbc-private.pem > > certificate = /etc/kamailio/certs/godaddy.pem > > ca_list = /etc/kamailio/certs/godaddyca.pem > > > > In the section above the ca_list is godaddy’s ca and subordinate. > > > > > > In the wireshark I can see that I’m sending out SIP OPTIONS PING (I’m > using dispatcher module). > > Then the server replies with tls SERVER HELLO which includes it’s > certificate > > But for some reason we are rejecting it: > > Alert (level: fatal, Description: Unknown CA) > > > > How should I set this up to make sure the remote server CA’s are verified? > > > > I am not sure I understand what you want to do -- to verify that the list > of CAs trusted by the remote server? This is not possible, what is trusted > by the server is its own business. An entity can verify only of the > presented certificate by a peer is signed by a trusted CA from its CAs > trusted list. > > Cheers, > Daniel > > -- > > Daniel-Constantin Mierla -- www.asipto.com > > www.twitter.com/miconda -- www.linkedin.com/in/miconda > > Funding: https://www.paypal.me/dcmierla > > --> > > -- > > Daniel-Constantin Mierla -- www.asipto.com > > www.twitter.com/miconda -- www.linkedin.com/in/miconda > > Funding: https://www.paypal.me/dcmierla > > --> > _______________________________________________ > Kamailio (SER) - Users Mailing List > [email protected] > https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users > > _______________________________________________ > Kamailio (SER) - Users Mailing List > [email protected] > https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users >
_______________________________________________ Kamailio (SER) - Users Mailing List [email protected] https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
