Hi All, *Running: *opensips-2.3.1-1.el7.x86_64 / CentOS 7
I have been working with new TLS connection and have been having problems validating their client certificate. My OpenSIPs configuration works fine for other providers (i.e. Twilio) however I am seeing the following error messages reported while verify_cert is enabled: Jul 25 13:10:32 proxy.ex.com opensips[4881]: NOTICE:tls_mgm:verify_callback: depth = 0 Jul 25 13:10:32 proxy.ex.com opensips[4881]: NOTICE:tls_mgm:verify_callback: subject = /serialNumber=03379831/1.3.6.1.4.1.311.60.2.1.3=GB/businessCategory=Private Organization/C=GB/postalCode=SO16 7NP/L=Southampton/street=2 Venture Road/O=SIMWOOD ESMS LIMITED/OU=COMODO EV Multi-Domain SSL/CN=simwood.com Jul 25 13:10:32 proxy.ex.com opensips[4881]: NOTICE:tls_mgm:verify_callback: verify error:num=20:unable to get local issuer certificate Jul 25 13:10:32 proxy.ex.com opensips[4881]: NOTICE:tls_mgm:verify_callback: something wrong with the cert ... error code is 20 (check x509_vfy.h) Jul 25 13:10:32 proxy.ex.com opensips[4881]: NOTICE:tls_mgm:verify_callback: verify return:0 Jul 25 13:10:32 proxy.ex.com opensips[4881]: ERROR:proto_tls:tls_accept: New TLS connection from 178.22.140.34:34281 failed to accept Jul 25 13:10:32 proxy.ex.com opensips[4881]: ERROR:proto_tls:tls_print_errstack: TLS errstack: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Jul 25 13:10:32 proxy.ex.com opensips[4881]: ERROR:proto_tls:tls_read_req: failed to do pre-tls reading Part of my reason for resorting to the mailing list are old mailing list emails discussing that multi-domain certificates are not supported by OpenSIPs - is anyone able to confirm if this remains a problem? The openssl error code 20 is translated as X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY I have seen other reports that this issue may be related to an improperly chained certificate - does this sound at all likely? Any tips on debugging would be greatly appreciated, thanks. Callum -- Callum Guy Head of Information Security X-on -- *0333 332 0000 | www.x-on.co.uk <http://www.x-on.co.uk> | ** <https://www.linkedin.com/company/x-on> <https://www.facebook.com/XonTel> <https://twitter.com/xonuk> * X-on is a trading name of Storacall Technology Ltd a limited company registered in England and Wales. Registered Office : Avaland House, 110 London Road, Apsley, Hemel Hempstead, Herts, HP3 9SD. Company Registration No. 2578478. The information in this e-mail is confidential and for use by the addressee(s) only. If you are not the intended recipient, please notify X-on immediately on +44(0)333 332 0000 and delete the message from your computer. If you are not a named addressee you must not use, disclose, disseminate, distribute, copy, print or reply to this email. Views or opinions expressed by an individual within this email may not necessarily reflect the views of X-on or its associated companies. Although X-on routinely screens for viruses, addressees should scan this email and any attachments for viruses. X-on makes no representation or warranty as to the absence of viruses in this email or any attachments.
_______________________________________________ Users mailing list [email protected] http://lists.opensips.org/cgi-bin/mailman/listinfo/users
