Secure VoIP - Revision history

Webmaster at 15:50, 18 July 2011

2011-07-18T15:50:15Z

← Older revision		Revision as of 15:50, 18 July 2011
Line 1:		Line 1:
-	~~THIS PAGE IS UNDER CONSTRUCTION~~!	+	SIP/TLS and SRTP are experimental!

	This will require the asterisk16 or asterisk18 packages for SIP/TLS and asterisk18 for SRTP (encrypted media). Also make sure to use the latest ipbx package release. If you would like to change your Asterisk version, you can use the [[Upgrading#Upgrading_using_the_Switch_Updater\|Switch Updater]] script.		This will require the asterisk16 or asterisk18 packages for SIP/TLS and asterisk18 for SRTP (encrypted media). Also make sure to use the latest ipbx package release. If you would like to change your Asterisk version, you can use the [[Upgrading#Upgrading_using_the_Switch_Updater\|Switch Updater]] script.

2011-07-18T15:49:28Z

Setting up ipbx for TLS Use

← Older revision		Revision as of 15:49, 18 July 2011
Line 71:		Line 71:
	tlsdontverifyserver = no		tlsdontverifyserver = no
	...		...
		+
		+	Restart Asterisk:
		+
		+	[root@ipbx ~]# service asterisk restart
		+
		+	Asterisk should now be listening on port 5061. Double check the CLI by issuing a 'sip reload'.

	==Setting up your Device==		==Setting up your Device==

2011-07-18T15:47:33Z

Setting up ipbx for TLS Use

← Older revision		Revision as of 15:47, 18 July 2011
Line 59:		Line 59:

	==Setting up ipbx for TLS Use==		==Setting up ipbx for TLS Use==
		+
		+	Go to → '''Manual Editor''' → '''SIP Configuration''' → '''Edit''' and add the following parameters:
		+
		+	[general]
		+	...
		+	tcpenable = yes
		+	tcpbindaddr = xxx.xxx.xxx.xxx:5060
		+	tlsenable = yes
		+	tlsbindaddr = xxx.xxx.xxx.xxx:5061
		+	tlscertfile = /etc/asterisk/asterisk.pem
		+	tlsdontverifyserver = no
		+	...

	==Setting up your Device==		==Setting up your Device==

2011-07-15T12:33:11Z

Counterpath Bria

← Older revision		Revision as of 12:33, 15 July 2011
Line 80:		Line 80:
	# Make sure your proxy and registrar ports are set to 5061		# Make sure your proxy and registrar ports are set to 5061

-	==== Counterpath Bria ====	+	==== Counterpath Bria for iPhone ====
		+
	Counterpath softphones use your operating system's certificate store to verify your TLS certificates.		Counterpath softphones use your operating system's certificate store to verify your TLS certificates.
-	Place the ca.crt file on a webserver and load it using your browser to store it in our operatings system's certificate store. Use Internet Explorer for Windows or Safari for OS X and iOS (iPhone & iPad) operating systems.	+	Place the ca.crt file on a webserver and load it using your browser to store it in our operatings system's certificate store. Use Internet Explorer for Windows or Safari for OS X and iOS (iPhone & iPad) operating systems. For further details on how to setup Bria see [[Bria_for_iPhone_Setup\|Bria for iPhone Setup]].

2011-07-15T12:31:34Z

← Older revision		Revision as of 12:31, 15 July 2011
Line 1:		Line 1:
	THIS PAGE IS UNDER CONSTRUCTION!		THIS PAGE IS UNDER CONSTRUCTION!

-	This will require the asterisk16 or asterisk18 packages for SIP/TLS and asterisk18 for SRTP (encrypted media). Also make sure to use the latest ipbx package release.	+	This will require the asterisk16 or asterisk18 packages for SIP/TLS and asterisk18 for SRTP (encrypted media). Also make sure to use the latest ipbx package release. If you would like to change your Asterisk version, you can use the [[Upgrading#Upgrading_using_the_Switch_Updater\|Switch Updater]] script.

	==Configuring SIP/TLS==		==Configuring SIP/TLS==

2010-08-25T16:14:12Z

Creating a Key File and CA

← Older revision		Revision as of 16:14, 25 August 2010
Line 42:		Line 42:
	An optional company name []:		An optional company name []:

-	Make sure your common name matches your server. Some phones will check for a matching name!	+	Make sure your common name (CN) matches your server. Some phones will check for a matching name! This also means that your phone will have to be configured with the common name.

	===Creating a Self-Signed Certificate===		===Creating a Self-Signed Certificate===

2010-08-25T14:09:09Z

Counterpath Bria

← Older revision		Revision as of 14:09, 25 August 2010
Line 81:		Line 81:

	==== Counterpath Bria ====		==== Counterpath Bria ====
-		+	Counterpath softphones use your operating system's certificate store to verify your TLS certificates.
	Place the ca.crt file on a webserver and load it using your browser to store it in our operatings system's certificate store. Use Internet Explorer for Windows or Safari for OS X and iOS (iPhone & iPad) operating systems.		Place the ca.crt file on a webserver and load it using your browser to store it in our operatings system's certificate store. Use Internet Explorer for Windows or Safari for OS X and iOS (iPhone & iPad) operating systems.

2010-08-25T13:49:16Z

← Older revision		Revision as of 13:49, 25 August 2010
Line 1:		Line 1:
	THIS PAGE IS UNDER CONSTRUCTION!		THIS PAGE IS UNDER CONSTRUCTION!
		+
		+	This will require the asterisk16 or asterisk18 packages for SIP/TLS and asterisk18 for SRTP (encrypted media). Also make sure to use the latest ipbx package release.

	==Configuring SIP/TLS==		==Configuring SIP/TLS==

2010-08-24T12:26:19Z

Creating a Key File and CA

← Older revision		Revision as of 12:26, 24 August 2010
Line 5:		Line 5:
	===Creating a Key File and CA===		===Creating a Key File and CA===

-	You can use your CA to sign your server certificate or you can use a commercial certificate.	+	You can use your CA to sign your server certificate or you can use a commercial certificate from places such as http://www.verisign.com/.

	$ openssl genrsa -des3 -out ca.key 4096		$ openssl genrsa -des3 -out ca.key 4096

2010-08-24T12:25:41Z

Creating a Key File and CA

← Older revision		Revision as of 12:25, 24 August 2010
Line 4:		Line 4:

	===Creating a Key File and CA===		===Creating a Key File and CA===
		+
		+	You can use your CA to sign your server certificate or you can use a commercial certificate.

	$ openssl genrsa -des3 -out ca.key 4096		$ openssl genrsa -des3 -out ca.key 4096
Line 9:		Line 11:
	$ openssl req -new -x509 -days 365 -key ca.key -out ca.crt		$ openssl req -new -x509 -days 365 -key ca.key -out ca.crt

-	Sample CA Cert	+	'''Sample CA Cert'''

	Country Name (2 letter code) [GB]:US		Country Name (2 letter code) [GB]:US
Line 21:		Line 23:
	$ openssl genrsa -out key.pem 1024		$ openssl genrsa -out key.pem 1024

-	Certificate Signing Request	+	'''Sample Certificate Signing Request'''

	$ openssl req -new -key key.pem -out req-ipbx_taridium.csr		$ openssl req -new -key key.pem -out req-ipbx_taridium.csr