Re: TLS issue

--===============1369651572==
Content-Type: multipart/alternative; boundary="0000000000007774e60654eade67"

--0000000000007774e60654eade67
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

it looks like Voxbone also includes the root certificate in its chain

% : | openssl s_client -connect voxout.voxbone.com:5061 2>/dev/null | sed
-n '/Certificate chain/,/^---/p'
Certificate chain
 0 s:C=3DBE, L=3DIxelles, O=3DVoxbone S.A., CN=3D*.voxout.voxbone.com
   i:C=3DUS, O=3DDigiCert Inc, CN=3DDigiCert Global G2 TLS RSA SHA256 2020 =
CA1
   a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: May 20 00:00:00 2026 GMT; NotAfter: Nov 25 23:59:59 2026 GM=
T
 1 s:C=3DUS, O=3DDigiCert Inc, CN=3DDigiCert Global G2 TLS RSA SHA256 2020 =
CA1
   i:C=3DUS, O=3DDigiCert Inc, OU=3Dwww.digicert.com, CN=3DDigiCert Global =
Root G2
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Mar 30 00:00:00 2021 GMT; NotAfter: Mar 29 23:59:59 2031 GM=
T
 2 s:C=3DUS, O=3DDigiCert Inc, OU=3Dwww.digicert.com, CN=3DDigiCert Global =
Root G2
   i:C=3DUS, O=3DDigiCert Inc, OU=3Dwww.digicert.com, CN=3DDigiCert Global =
Root G2
   a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Aug  1 12:00:00 2013 GMT; NotAfter: Jan 15 12:00:00 2038 GM=
T
---

IMO it they should only sent the first two certificates.

Regards,
Bastian

On Mon, Jun 22, 2026 at 11:47=E2=80=AFPM Martin Nystr=C3=B6m via sr-users <
[email protected]> wrote:

> Hi,
>
> I am trying to wrap my head around this error (external IPs has been
> scrambled):
>
> ERROR: tls [tls_server.c:1626]: tls_h_read_mp_f(): protocol level error
> ERROR: tls [tls_util.h:56]: tls_err_ret(): TLS connect:error:0A000413:SSL
> routines::sslv3 alert unsupported certificate (sni: unknown)
> ERROR: tls [tls_server.c:1630]: tls_h_read_mp_f(): src addr:
> 195.25.22.11:5061
> ERROR: tls [tls_server.c:1633]: tls_h_read_mp_f(): dst addr:
> 10.3.126.39:54808
>
> What raises the sni known error?
>
> This is out tls.cfg, the provider in question is named =E2=80=9Cfoobar=E2=
=80=9D which we
> are selecting before route relay.
> tls_set_connect_server_id(=E2=80=9Cfoobar");
>
>
> [server:default]
> method =3D TLSv1.2+
> verify_certificate =3D no
> require_certificate =3D no
> private_key =3D /etc/kamailio/certs/domain/privkey.pem
> certificate =3D /etc/kamailio/certs/domain/fullchain.pem
>
>
> [client:default]
> method =3D TLSv1.2+
> verify_certificate =3D no
> require_certificate =3D no
> #private_key =3D /etc/kamailio/certs/domain/privkey.pem
> #certificate =3D /etc/kamailio/certs/domain/fullchain.pem
> ca_list =3D /etc/ssl/certs/ca-certificates.crt
>
>
> [client:any]
> server_id =3D foobar
> method =3D TLSv1.2+
> verify_certificate =3D no
> require_certificate =3D no
> private_key =3D /etc/kamailio/certs/domain/privkey.pem
> certificate =3D /etc/kamailio/certs/domain/fullchain.pem
> ca_list =3D /etc/ssl/certs/ca-certificates.crt
> server_name =3D sip.foobar.com
> server_name_mode =3D 1
>
>
> [client:any]
> server_id =3D voxbone
> method =3D TLSv1.2+
> verify_certificate =3D no
> require_certificate =3D no
> ca_list =3D /etc/ssl/certs/ca-certificates.crt
> server_name =3D voxout.voxbone.com
> server_name_mode =3D 1
>
>
>
> I am running with tls_debug 10 but I am at a lost here. Incoming calls
> from the provider works just fine, I guess the server:default is used in
> that case. Now the server_id voxbone is working with the above
> configuration. But I am trying to wrap my head around the error raised fo=
r
> the foobar provider.
>
> We are selecting the dispatcher with the destination sip:sip.foobar.com
> ;transport=3DTLS
>
>
> /M
> __________________________________________________________
> Kamailio - Users Mailing List - Non Commercial Discussions --
> [email protected]
> To unsubscribe send an email to [email protected]
> Important: keep the mailing list in the recipients, do not reply only to
> the sender!
>

--0000000000007774e60654eade67
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">it looks like Voxbone also includes the root certificate i=
n its chain<div><br></div><div>% : | openssl s_client -connect <a href=3D"h=
ttp://voxout.voxbone.com:5061">voxout.voxbone.com:5061</a> 2&gt;/dev/null |=
 sed -n &#39;/Certificate chain/,/^---/p&#39;<br>Certificate chain<br>=C2=
=A00 s:C=3DBE, L=3DIxelles, O=3DVoxbone S.A., CN=3D*.<a href=3D"http://voxo=
ut.voxbone.com">voxout.voxbone.com</a><br>=C2=A0 =C2=A0i:C=3DUS, O=3DDigiCe=
rt Inc, CN=3DDigiCert Global G2 TLS RSA SHA256 2020 CA1<br>=C2=A0 =C2=A0a:P=
KEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption<br>=C2=A0 =C2=A0v:Not=
Before: May 20 00:00:00 2026 GMT; NotAfter: Nov 25 23:59:59 2026 GMT<br>=C2=
=A01 s:C=3DUS, O=3DDigiCert Inc, CN=3DDigiCert Global G2 TLS RSA SHA256 202=
0 CA1<br>=C2=A0 =C2=A0i:C=3DUS, O=3DDigiCert Inc, OU=3D<a href=3D"http://ww=
w.digicert.com">www.digicert.com</a>, CN=3DDigiCert Global Root G2<br>=C2=
=A0 =C2=A0a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption<br>=C2=
=A0 =C2=A0v:NotBefore: Mar 30 00:00:00 2021 GMT; NotAfter: Mar 29 23:59:59 =
2031 GMT<br>=C2=A02 s:C=3DUS, O=3DDigiCert Inc, OU=3D<a href=3D"http://www.=
digicert.com">www.digicert.com</a>, CN=3DDigiCert Global Root G2<br>=C2=A0 =
=C2=A0i:C=3DUS, O=3DDigiCert Inc, OU=3D<a href=3D"http://www.digicert.com">=
www.digicert.com</a>, CN=3DDigiCert Global Root G2<br>=C2=A0 =C2=A0a:PKEY: =
RSA, 2048 (bit); sigalg: sha256WithRSAEncryption<br>=C2=A0 =C2=A0v:NotBefor=
e: Aug =C2=A01 12:00:00 2013 GMT; NotAfter: Jan 15 12:00:00 2038 GMT<br>---=
<br></div><div><br></div><div>IMO it they should only sent the first two ce=
rtificates.</div><div><br></div><div>Regards,</div><div>Bastian</div></div>=
<br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=
=3D"gmail_attr">On Mon, Jun 22, 2026 at 11:47=E2=80=AFPM Martin Nystr=C3=B6=
m via sr-users &lt;<a href=3D"mailto:[email protected]">sr-users@=
lists.kamailio.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote=
" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);=
padding-left:1ex">



<div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
Hi,</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
I am trying to wrap my head around this error (external IPs has been scramb=
led):</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
ERROR: tls [tls_server.c:1626]: tls_h_read_mp_f(): protocol level error</di=
v>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
ERROR: tls [tls_util.h:56]: tls_err_ret(): TLS connect:error:0A000413:SSL r=
outines::sslv3 alert unsupported certificate (sni: unknown)</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
ERROR: tls [tls_server.c:1630]: tls_h_read_mp_f(): src addr: <a href=3D"htt=
p://195.25.22.11:5061" target=3D"_blank">195.25.22.11:5061</a></div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
ERROR: tls [tls_server.c:1633]: tls_h_read_mp_f(): dst addr: <a href=3D"htt=
p://10.3.126.39:54808" target=3D"_blank">10.3.126.39:54808</a></div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
What raises the sni known error?</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
This is out tls.cfg, the provider in question is named =E2=80=9Cfoobar=E2=
=80=9D which we are selecting before route relay.</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
tls_set_connect_server_id(=E2=80=9Cfoobar&quot;);</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
[server:default]</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
method =3D TLSv1.2+</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
verify_certificate =3D no</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
require_certificate =3D no</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
private_key =3D /etc/kamailio/certs/domain/privkey.pem</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
certificate =3D /etc/kamailio/certs/domain/fullchain.pem</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
[client:default]</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
method =3D TLSv1.2+</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
verify_certificate =3D no</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
require_certificate =3D no</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
#private_key =3D /etc/kamailio/certs/domain/privkey.pem</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
#certificate =3D /etc/kamailio/certs/domain/fullchain.pem</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
ca_list =3D /etc/ssl/certs/ca-certificates.crt</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
[client:any]</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
server_id =3D foobar</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
method =3D TLSv1.2+</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
verify_certificate =3D no</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
require_certificate =3D no</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
private_key =3D /etc/kamailio/certs/domain/privkey.pem</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
certificate =3D /etc/kamailio/certs/domain/fullchain.pem</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
ca_list =3D /etc/ssl/certs/ca-certificates.crt</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
server_name =3D <a href=3D"http://sip.foobar.com" target=3D"_blank">sip.foo=
bar.com</a></div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
server_name_mode =3D 1</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
[client:any]</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
server_id =3D voxbone</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
method =3D TLSv1.2+</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
verify_certificate =3D no</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
require_certificate =3D no</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
ca_list =3D /etc/ssl/certs/ca-certificates.crt</div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
server_name =3D <a href=3D"http://voxout.voxbone.com" target=3D"_blank">vox=
out.voxbone.com</a></div>
<div style=3D"font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;c=
olor:rgb(0,0,0)">
server_name_mode =3D 1</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
I am running with tls_debug 10 but I am at a lost here. Incoming calls from=
 the provider works just fine, I guess the server:default is used in that c=
ase. Now the server_id voxbone is working with the above configuration. But=
 I am trying to wrap my head around
 the error raised for the foobar provider.</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
We are selecting the dispatcher with the destination sip:<a href=3D"http://=
sip.foobar.com" target=3D"_blank">sip.foobar.com</a>;transport=3DTLS</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;fo=
nt-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style=3D"color:inherit;background-color:inherit" id=3D"m_-733096766940=
5062268ms-outlook-mobile-signature">
<div class=3D"MsoNormal" style=3D"font-size:12pt">/M</div>
</div>
</div>

__________________________________________________________<br>
Kamailio - Users Mailing List - Non Commercial Discussions -- <a href=3D"ma=
ilto:[email protected]" target=3D"_blank">[email protected]=
.org</a><br>
To unsubscribe send an email to <a href=3D"mailto:[email protected]=
ilio.org" target=3D"_blank">[email protected]</a><br>
Important: keep the mailing list in the recipients, do not reply only to th=
e sender!<br>
</blockquote></div>

--0000000000007774e60654eade67--

--===============1369651572==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the sender!

--===============1369651572==--