Re: TLS issue
B K via sr-users <[email protected]> Tue, 23 Jun 2026 05:25:30 -0500
| Newsgroups | gmane.comp.voip.ser |
|---|---|
| Message-ID | <CAN9RubQZRRnZ6aaFQbPnrOpPRaZAXJgcMRHVePrpOxHF4cieeQ@mail.gmail.com> |
--===============1795838252== Content-Type: multipart/alternative; boundary="000000000000365da90654e92eb6" --000000000000365da90654e92eb6 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Is your certificate file only your certificate or does it include the intermediary from Let's Encrypt? On Tue, Jun 23, 2026, 1:32=E2=80=AFAM Martin Nystr=C3=B6m <martin.nystrom@c= onnectel.se> wrote: > Hi, > > As I understand we can have as many client:any as we want, and then pick > them in the routing by using tls_set_connect_server_id(). Is this > assumption not correct? > > Anyways, I did a test with openssl towards the foobar provider. And I did > discover SSL alert number 48 which translates to =E2=80=9Cunknown ca=E2= =80=9D. So my > guess is they do not accept my certificate, despite them having specified > that Letsencrypt is supported. I think it is a dialogue I have to take wi= th > then. > > But I would like to continue the discussion on my tls config, having > multiple client:any and making in-routing selections. If this is supporte= d, > or not. And what implications it can have. > > /M > *From: *B K via sr-users <[email protected]> > *Date: *Tuesday, 23 June 2026 at 00:45 > *To: *Kamailio (SER) - Users Mailing List <[email protected]> > *Cc: *B K <[email protected]> > *Subject: *[SR-Users] Re: TLS issue > > *CAUTION:* This email originated from outside the organization. Do not > click links or open attachments unless you recognize the sender and know > the content is safe. > > > Backing out on this a little a few points: > > sni is "Server Name Indicator", and is used for matching names presented > in the certificate (either in the name itself of subject alternate names)= . > > Next, remember that TLS transport doesn't by default re-use TLS sessions, > even for the same dialog. You say "incoming calls work fine from this > provider, until we send a BYE", but the "call" contains the entire dialog= . > If the BYE fails, then the call fails. So, the question is: Is the tls > handshake failing whenever your Kamailio proxy attempts a handshake with > that server, and if so, who's rejecting it? (check your packet capture to > see the TLS negotiation failure). From this it looks like it's when you > send a request to `sip.foobar.com`, where you're the client. > > Next, looking at your TLS config, you have two sections named > `[client:any]`. Which one should apply? Looking at the examples in the > tls module code ( > https://github.com/kamailio/kamailio/blob/master/src/modules/tls/tls.cfg) > each section would be like `client:ip_address:port`. I don't know if > `client:hostname:port` would also work or not, however it looks like you > have two conflicting sections, and my guess would be that your voxbone > section is clobbering the foobar section. > > You might also want to use `openssl s_channel` to test the handshake > alone, as it's probably faster than testing with actual calls. > > On Mon, Jun 22, 2026 at 5:04=E2=80=AFPM Martin Nystr=C3=B6m via sr-users = < > [email protected]> wrote: > > It is confirmed in their specification that they require TLS 1.2. > > A hint in all this, is that incoming calls work fine from this provider, > until we send a BYE. Then it fails with the same error. > > We are running 6.1.2 by the way. > > /M > *From: *Fred Posner <[email protected]> > *Date: *Monday, 22 June 2026 at 23:32 > *To: *Kamailio (SER) - Users Mailing List <[email protected]> > *Cc: *Martin Nystr=C3=B6m <[email protected]> > *Subject: *Re: [SR-Users] TLS issue > > CAUTION: This email originated from outside the organization. Do not clic= k > links or open attachments unless you recognize the sender and know the > content is safe. > > > > Have you made sure they are using TLS 1.2 or higher? > > > Regards, > > Fred Posner > > > > > > > On Jun 22, 2026, at 4:56=E2=80=AFPM, Martin Nystr=C3=B6m via sr-users < > [email protected]> wrote: > > > > ERROR: tls [tls_util.h:56]: tls_err_ret(): TLS > connect:error:0A000413:SSL routines::sslv3 alert unsupported certificate > (sni: unknown) > > > > __________________________________________________________ > Kamailio - Users Mailing List - Non Commercial Discussions -- > [email protected] > To unsubscribe send an email to [email protected] > Important: keep the mailing list in the recipients, do not reply only to > the sender! > > --000000000000365da90654e92eb6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto">Is your certificate file only your certificate or does it= include the intermediary from Let's Encrypt?</div><br><div class=3D"gm= ail_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On T= ue, Jun 23, 2026, 1:32=E2=80=AFAM Martin Nystr=C3=B6m <<a href=3D"mailto= :[email protected]">[email protected]</a>> wrote:<br= ></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-= left:1px #ccc solid;padding-left:1ex"> <div> <div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo= nt-size:12pt;color:rgb(0,0,0)"> Hi,</div> <div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo= nt-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo= nt-size:12pt;color:rgb(0,0,0)"> As I understand we can have as many client:any as we want, and then pick th= em in the routing by using <span style=3D"background-color:rgb(255,255,255);text-transform:none">tls_s= et_connect_server_id(). Is this assumption not correct?</span></div> <div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo= nt-size:12pt;color:rgb(0,0,0)"> <span style=3D"background-color:rgb(255,255,255);text-transform:none"><br> </span></div> <div style=3D"direction:ltr"><span style=3D"font-family:Aptos,Arial,Helveti= ca,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,= 255)">Anyways, I did a test with openssl towards the foobar provider. And I= did discover </span><span style=3D"font-size:16px;color:rgb(0,0,0);background-color:rgb(= 255,255,255)">SSL alert number 48 which translates to </span><span style=3D"background-color:rgb(255,255,255)">=E2=80=9C</span><s= pan style=3D"font-size:16px;color:rgb(0,0,0);background-color:rgb(255,255,2= 55)">unknown ca</span><span style=3D"font-size:16px;background-color:rgb(25= 5,255,255)">=E2=80=9D</span><span style=3D"font-size:16px;color:rgb(0,0,0);= background-color:rgb(255,255,255)">. So my guess is they do not accept my certificate, despite them having spec= ified that Letsencrypt is supported. I think it is a dialogue I have to tak= e with then.</span></div> <div style=3D"direction:ltr;font-size:16px;color:rgb(0,0,0)"><span style=3D= "background-color:rgb(255,255,255)"><br> </span></div> <div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo= nt-size:16px;color:rgb(0,0,0)"> <span style=3D"background-color:rgb(255,255,255)">But I would like to conti= nue the discussion on my tls config, having multiple client:any and making = in-routing selections. If this is supported, or not. And what implications = it can have.</span></div> <div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo= nt-size:12pt;color:rgb(0,0,0)"> <br> </div> <div style=3D"color:inherit;background-color:inherit" id=3D"m_-875992173903= 0970910ms-outlook-mobile-signature"> <div class=3D"MsoNormal" style=3D"font-size:12pt">/M</div> </div> <div id=3D"m_-8759921739030970910mail-editor-reference-message-container" s= tyle=3D"color:inherit;background-color:inherit"> <div style=3D"direction:ltr"> </div> <div style=3D"padding:3pt 0in 0in;border-width:1pt medium medium;border-sty= le:solid none none;border-color:rgb(181,196,223) currentcolor currentcolor"= > <div style=3D"text-align:left;font-family:Aptos;font-size:12pt;color:black"= > <b>From: </b>B K via sr-users <<a href=3D"mailto:[email protected]= .org" target=3D"_blank" rel=3D"noreferrer">[email protected]</a>&= gt;<br> <b>Date: </b>Tuesday, 23 June 2026 at 00:45<br> <b>To: </b>Kamailio (SER) - Users Mailing List <<a href=3D"mailto:sr-use= [email protected]" target=3D"_blank" rel=3D"noreferrer">sr-users@lists.= kamailio.org</a>><br> <b>Cc: </b>B K <<a href=3D"mailto:[email protected]" target=3D= "_blank" rel=3D"noreferrer">[email protected]</a>><br> <b>Subject: </b>[SR-Users] Re: TLS issue<br> <br> </div> </div> <table align=3D"left" cellspacing=3D"0" cellpadding=3D"0" border=3D"0"> <tbody> <tr> <td style=3D"background-color:rgb(187,165,85);padding:5.25pt 5.5pt 5.25pt 1= .5pt"> </td> <td style=3D"background-color:rgb(255,229,153);padding:5.25pt 3.75pt 5.25pt= 11.25pt;width:100%"> <p><span style=3D"font-family:Arial,sans-serif;font-size:11pt;color:rgb(33,= 33,33)"><b>CAUTION:</b>=C2=A0This email originated from outside the organiz= ation. Do not click links or open attachments unless you recognize the sender and know the content is safe.</span></p> </td> </tr> </tbody> </table> <div style=3D"direction:ltr"> <br> <br> </div> <div style=3D"direction:ltr"> Backing out on this a little a few points:</div> <div style=3D"direction:ltr"> <br> </div> <div style=3D"direction:ltr"> sni is "Server Name Indicator", and is used for matching names pr= esented in the certificate (either in the name itself of subject alternate = names).=C2=A0=C2=A0</div> <div style=3D"direction:ltr"> <br> </div> <div style=3D"direction:ltr"> Next, remember that TLS transport doesn't by default re-use TLS session= s, even for the same dialog.=C2=A0 You say "incoming calls work fine f= rom this provider, until we send a BYE", but the "call" cont= ains the entire dialog.=C2=A0 If the BYE fails, then the call fails. So, the question is:=C2=A0 Is the tls handshake failing whenever your Kama= ilio proxy attempts=C2=A0a handshake with that server, and if so, who's= rejecting it? (check your packet capture to see the TLS negotiation failur= e).=C2=A0 From this it looks like it's when you send a request to `<a href=3D"http://sip.foobar.com" target=3D"_blank" rel=3D"n= oreferrer">sip.foobar.com</a>`, where you're the client.</div> <div style=3D"direction:ltr"> <br> </div> <div style=3D"direction:ltr"> Next, looking at your TLS config, you have two sections named `[client:any]= `.=C2=A0 Which one should apply?=C2=A0 Looking at the examples in=C2=A0the = tls module code (<a href=3D"https://github.com/kamailio/kamailio/blob/maste= r/src/modules/tls/tls.cfg" target=3D"_blank" rel=3D"noreferrer">https://git= hub.com/kamailio/kamailio/blob/master/src/modules/tls/tls.cfg</a>) each section would be like `client:ip_address:port`.=C2=A0 I don't kno= w if `client:hostname:port` would also work or not, however it looks like y= ou have two conflicting sections, and my guess would be that your voxbone s= ection is clobbering the foobar section.</div> <div style=3D"direction:ltr"> <br> </div> <div style=3D"direction:ltr"> You might also want to use `openssl s_channel` to test the handshake alone,= as it's probably faster than testing with actual calls.</div> <div style=3D"direction:ltr"> <br> </div> <div class=3D"gmail_attr" style=3D"direction:ltr">On Mon, Jun 22, 2026 at 5= :04=E2=80=AFPM Martin Nystr=C3=B6m via sr-users <<a href=3D"mailto:sr-us= [email protected]" target=3D"_blank" rel=3D"noreferrer">sr-users@lists= .kamailio.org</a>> wrote:</div> <blockquote style=3D"margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left:= 1px solid rgb(204,204,204)"> <div class=3D"gmail_quote" style=3D"direction:ltr;font-family:Aptos,Arial,H= elvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> It is confirmed in their specification that they require TLS 1.2.</div> <div class=3D"gmail_quote" style=3D"direction:ltr;font-family:Aptos,Arial,H= elvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div class=3D"gmail_quote" style=3D"direction:ltr;font-family:Aptos,Arial,H= elvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> A hint in all this, is that incoming calls work fine from this provider, un= til we send a BYE. Then it fails with the same error.</div> <div class=3D"gmail_quote" style=3D"direction:ltr;font-family:Aptos,Arial,H= elvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div class=3D"gmail_quote" style=3D"direction:ltr;font-family:Aptos,Arial,H= elvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> We are running 6.1.2 by the way.</div> <div class=3D"gmail_quote" style=3D"direction:ltr;font-family:Aptos,Arial,H= elvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"> <br> </div> <div id=3D"m_-8759921739030970910m_-2837747772298000535ms-outlook-mobile-si= gnature" style=3D"color:inherit;background-color:inherit"> <div class=3D"MsoNormal" style=3D"font-size:12pt">/M</div> </div> <div id=3D"m_-8759921739030970910m_-2837747772298000535mail-editor-referenc= e-message-container" style=3D"color:inherit;background-color:inherit"> <div style=3D"padding:3pt 0in 0in;border-width:1pt medium medium;border-sty= le:solid none none;border-color:rgb(181,196,223) currentcolor currentcolor"= > <div style=3D"text-align:left;font-family:Aptos;font-size:12pt;color:black"= > <b>From: </b>Fred Posner <<a href=3D"mailto:[email protected]" target=3D"_bla= nk" rel=3D"noreferrer">[email protected]</a>><br> <b>Date: </b>Monday, 22 June 2026 at 23:32<br> <b>To: </b>Kamailio (SER) - Users Mailing List <<a href=3D"mailto:sr-use= [email protected]" target=3D"_blank" rel=3D"noreferrer">sr-users@lists.= kamailio.org</a>><br> <b>Cc: </b>Martin Nystr=C3=B6m <<a href=3D"mailto:martin.nystrom@connect= el.se" target=3D"_blank" rel=3D"noreferrer">[email protected]</a>= ><br> <b>Subject: </b>Re: [SR-Users] TLS issue<br> <br> </div> </div> <div style=3D"font-size:11pt">CAUTION: This email originated from outside t= he organization. Do not click links or open attachments unless you recogniz= e the sender and know the content is safe.<br> <br> <br> <br> Have you made sure they are using TLS 1.2 or higher?<br> <br> <br> Regards,<br> <br> Fred Posner<br> <br> <br> <br> <br> <br> > On Jun 22, 2026, at 4:56=E2=80=AFPM, Martin Nystr=C3=B6m via sr-users = <<a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D= "noreferrer">[email protected]</a>> wrote:<br> ><br> > ERROR: tls [tls_util.h:56]: tls_err_ret(): TLS connect:error:0A000413:= SSL routines::sslv3 alert unsupported certificate (sni: unknown)<br> ><br> <br> </div> </div> <div class=3D"gmail_quote">________________________________________________= __________<br> Kamailio - Users Mailing List - Non Commercial Discussions -- <a href=3D"ma= ilto:[email protected]" target=3D"_blank" rel=3D"noreferrer"> [email protected]</a><br> To unsubscribe send an email to <a href=3D"mailto:[email protected]= ilio.org" target=3D"_blank" rel=3D"noreferrer"> [email protected]</a><br> Important: keep the mailing list in the recipients, do not reply only to th= e sender!</div> </blockquote> </div> </div> </blockquote></div> --000000000000365da90654e92eb6-- --===============1795838252== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline __________________________________________________________ Kamailio - Users Mailing List - Non Commercial Discussions -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender! --===============1795838252==--