Secure VoIP
From Taridium
(→Counterpath Bria) |
(→Creating a Key File and CA) |
||
| Line 42: | Line 42: | ||
An optional company name []: | An optional company name []: | ||
| - | Make sure your common name matches your server. Some phones will check for a matching name! | + | Make sure your common name (CN) matches your server. Some phones will check for a matching name! This also means that your phone will have to be configured with the common name. |
===Creating a Self-Signed Certificate=== | ===Creating a Self-Signed Certificate=== | ||
Revision as of 16:14, 25 August 2010
THIS PAGE IS UNDER CONSTRUCTION!
This will require the asterisk16 or asterisk18 packages for SIP/TLS and asterisk18 for SRTP (encrypted media). Also make sure to use the latest ipbx package release.
Contents |
Configuring SIP/TLS
Creating a Key File and CA
You can use your CA to sign your server certificate or you can use a commercial certificate from places such as http://www.verisign.com/.
$ openssl genrsa -des3 -out ca.key 4096
$ openssl req -new -x509 -days 365 -key ca.key -out ca.crt
Sample CA Cert
Country Name (2 letter code) [GB]:US State or Province Name (full name) [Berkshire]:New York Locality Name (eg, city) [Newbury]:New York Organization Name (eg, company) [My Company Ltd]:Taridium Organizational Unit Name (eg, section) []:engineering Common Name (eg, your name or your server's hostname) []:Taridium CA www.taridium.com Email Address []:info@taridium.com
$ openssl genrsa -out key.pem 1024
Sample Certificate Signing Request
$ openssl req -new -key key.pem -out req-ipbx_taridium.csr
Country Name (2 letter code) [GB]:US State or Province Name (full name) [Berkshire]:New York Locality Name (eg, city) [Newbury]:New York Organization Name (eg, company) [My Company Ltd]:Taridium Organizational Unit Name (eg, section) []:engineering Common Name (eg, your name or your server's hostname) []:pbx.taridium.com Email Address []:support@taridium.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []:
Make sure your common name (CN) matches your server. Some phones will check for a matching name! This also means that your phone will have to be configured with the common name.
Creating a Self-Signed Certificate
To create the self-signed certificate, do the following:
$ openssl x509 -req -days 365 -in req-ipbx_taridium.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out cert-ipbx.cert
Installing the Certificate
$ cat key.pem > asterisk.pem $ cat cert-ipbx.cert >> asterisk.pem
$ mv asterisk.pem /etc/asterisk/ $ chown asterisk:asterisk /etc/asterisk/asterisk.pem
Setting up ipbx for TLS Use
Setting up your Device
ipbx Configuration
Device Configuration
Aastra
Aastra phones using TLS check for the following:
- Whether the certificate hasn't expired (make sure your NTP server is configured)
- Whether the CN (common name) of the certificate matches the SIP registrar and proxy
- Whether the certificate has been signed by a trusted entity. In the above case we have created our own CA certificate. See instructions below on how to place your CA certificate.
- Place the ca.crt file in your Aastra provisioning directory (on ipbx this is usually /var/www/html/prov)/
- Configure the Trusted Certificates Filename to be ca.crt
- In your Global SIP Settings select Advanced SIP Settings → Transport Protocol → Persistent TLS
- Make sure your proxy and registrar ports are set to 5061
Counterpath Bria
Counterpath softphones use your operating system's certificate store to verify your TLS certificates. Place the ca.crt file on a webserver and load it using your browser to store it in our operatings system's certificate store. Use Internet Explorer for Windows or Safari for OS X and iOS (iPhone & iPad) operating systems.
