Hi everyone!
I’m trying to get Asterisk 13.5 work with PJSIP and TLS with my snom370 VoIP phones, but it doesn’t work like I want it to and I can’t find my mistake(s).
Additional info: I have two servers running, both using the same OS Version, the same Asterisk version, the same phone models and firmware, the only difference is the protocol – SIP or PJSIP. The SIP server works totally fine.
I really hope you can help me.
This is my current setup:
[transport-tls]
bind=0.0.0.0:5061
ca_list_file=/etc/asterisk/keys/ca.crt
ca_list_path=/etc/asterisk/keys
cert_file=/etc/asterisk/keys/asterisk.crt
method=tlsv1 / sslv23 (I tried both)
priv_key_file=/etc/asterisk/keys/asterisk.key
protocol=tls
type=transport
Aor: <Aor..............................................> <MaxContact>
Contact: <Aor/ContactUri.................................> <Status....> <RTT(ms)..>
=========================================================================================
Aor: 935852 1
Contact: 935852/sip:935852@172.16.5.15:1222;transport=TLS; Unknown nan
ParameterName : ParameterValue
authenticate_qualify : false
contact : sip:935852@172.16.5.15:1222;transport=TLS;line=e8mthjh8
default_expiration : 3600
mailboxes :
max_contacts : 1
maximum_expiration : 540
minimum_expiration : 60
outbound_proxy :
qualify_frequency : 0
qualify_timeout : 3.000000
remove_existing : true
support_path : false
I/OAuth: <AuthId/UserName…>
Auth: 935852/935852
ParameterName : ParameterValue
auth_type : userpass
md5_cred :
nonce_lifetime : 32
password : …
realm :
username : 935852
Endpoint: <Endpoint/CID…> <State…> <Channels.>
I/OAuth: <AuthId/UserName…>
Aor: <Aor…>
Contact: <Aor/ContactUri…> <Status…> <RTT(ms)…>
Transport: <TransportId…> <BindAddress…>
Identify: <Identify/Endpoint…>
Match: <ip/cidr…>
Channel: <ChannelId…> <State…> <Time(sec)>
Exten: <DialedExten…> CLCID: <ConnectedLineCID…>
Endpoint: 935852/52 Not in use 0 of inf
InAuth: 935852/935852
Aor: 935852 1
Contact: 935852/sip:935852@172.16.5.15:1221;transport=TL Unknown nan
Transport: transport-tls tls 0 0 0.0.0.0:5061
ParameterName : ParameterValue
100rel : yes
accountcode :
aggregate_mwi : true
allow : (alaw)
allow_subscribe : true
allow_transfer : true
aors : 935852
auth : 935852
call_group :
callerid : “PJSIP-RECHTS” <52>
callerid_privacy : allowed_not_screened
callerid_tag :
connected_line_method : invite
context : area901
cos_audio : 0
cos_video : 0
device_state_busy_at : 0
direct_media : false
direct_media_glare_mitigation : none
direct_media_method : invite
disable_direct_media_on_nat : false
dtls_ca_file :
dtls_ca_path :
dtls_cert_file :
dtls_cipher :
dtls_fingerprint : SHA-256
dtls_private_key :
dtls_rekey : 0
dtls_setup : active
dtls_verify : No
dtmf_mode : rfc4733
fax_detect : false
force_avp : false
force_rport : false
from_domain :
from_user :
g726_non_standard : false
ice_support : false
identify_by : username
inband_progress : false
language : de
mailboxes :
media_address :
media_encryption : no
media_encryption_optimistic : false
media_use_received_transport : false
message_context :
moh_suggest : default
mwi_from_user :
named_call_group :
named_pickup_group :
one_touch_recording : false
outbound_auth :
outbound_proxy :
pickup_group :
record_off_feature : automixmon
record_on_feature : automixmon
rewrite_contact : true
rpid_immediate : false
rtp_engine : asterisk
rtp_ipv6 : false
rtp_keepalive : 0
rtp_symmetric : false
rtp_timeout : 0
rtp_timeout_hold : 0
sdp_owner : -
sdp_session : Asterisk
send_diversion : true
send_pai : false
send_rpid : false
set_var :
srtp_tag_32 : false
sub_min_expiry : 0
t38_udptl : false
t38_udptl_ec : none
t38_udptl_ipv6 : false
t38_udptl_maxdatagram : 0
t38_udptl_nat : false
timers : yes
timers_min_se : 90
timers_sess_expires : 1800
tone_zone :
tos_audio : 0
tos_video : 0
transport : transport-tls
trust_id_inbound : false
trust_id_outbound : false
use_avpf : false
use_ptime : false
user_eq_phone : false
I use the certificate and CA which can be made by the ast_tls_cert script -> these do work with TLS with SIP.
In the snom webinterface I activated the tls feature, accepted the certificate the server sends and added “…:5061;transport=tls” to the outbound proxy, like I did in SIP.
Now, every time I make a call, these messages occur:
[Oct 16 08:47:25] ERROR[1779]: pjsip:0 <?>: tlsc0x7faffc03 TLS connect() error: Connection refused [code=120111]
[Oct 16 08:47:25] WARNING[1779]: pjsip:0 <?>: tsx0x7faffc036 Failed to send Request msg NOTIFY/cseq=14187 (tdta0x7faffc046750)! err=120111 (Connection refused)
These messages also occur when I re-register the phones.
When I trace the network traffic, the calls are encrypted via TLS, but I can’t decrypt them with the certificate. So I think the whole encryption via my certificate doesn’t work at all and the encryption is only done by the phone itself -> this is not want I want.
I really would appreciate your help!
Best Regards