# Asterisk CA certificate path error **URL:** \ **Category:** Asterisk SIP\ **Created:** [April 15, 2021, 11:05am UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292 "2021-04-15T11:05:10Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![barryp](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@barryp](https://community.asterisk.org/u/barryp)\ **Post date:** [April 15, 2021, 11:05am UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/1 "2021-04-15T11:05:10Z")
I am using Asterisk 13.10.0 as a PBX and have an encrypted link to a SIP gateway server. The TLS is setup when asterisk is not checking the server certs but this is not secure. When I set tlsdontverifyserver=yes the link is setup. If i set this to No then tls is not setup. When i look at the full log I can see that it lloks like it is not happy with the calist.pem with the server cert authority trust chain. [Apr 15 11:36:58] ERROR[2353] tcptls.c: TLS/SSL CA file(/etc/asterisk/keys/calist.pem)/path() error The file path os correct in the sip.conf and teh file is owned by asterisk:asterisk So what does the /path() refer to ? I have been pulling my hair out on this for weeks now. The CA cert is used on different applications, so i believe this to be a correctly formatted certificate ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [April 15, 2021, 11:12am UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/2 "2021-04-15T11:12:22Z")
Newer versions of Asterisk will actually output the OpenSSL error message, and provide that information. ---
**Author:** ![barryp](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@barryp](https://community.asterisk.org/u/barryp)\ **Post date:** [April 15, 2021, 11:47am UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/3 "2021-04-15T11:47:04Z")
Changing Asterisk version is not an option for me unfortunately. Any other suggestions ? ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [April 15, 2021, 11:49am UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/4 "2021-04-15T11:49:44Z")
Then to answer your question, the message means that we called the OpenSSL function SSL\_CTX\_load\_verify\_locations with a file of “/etc/asterisk/keys/calist.pem” which did not return success. OpenSSL for some reason didn’t like the file or couldn’t access it for some reason. Someone else may have experienced the same issue and narrowed it down, but I haven’t seen it or remember it. ---
**Author:** ![barryp](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@barryp](https://community.asterisk.org/u/barryp)\ **Post date:** [April 15, 2021, 3:36pm UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/5 "2021-04-15T15:36:07Z")
Hi jcolp is there any open ssl commands i coudl use to validate the certifcate or try and see what the issue may be that you can think of ? ---
**Author:** ![barryp](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@barryp](https://community.asterisk.org/u/barryp)\ **Post date:** [April 15, 2021, 3:37pm UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/6 "2021-04-15T15:37:39Z")
Hi jcolp, The CA list is 4 certficates in a stack. That is supported by asterisk isn’t it ? ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [April 15, 2021, 3:39pm UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/7 "2021-04-15T15:39:06Z")
We, ourselves, don’t examine the file at all. We pass the filename to OpenSSL using the API call I previously mentioned, and it does everything. To that end I don’t know what that API call will do with that. It might be fine, it might not be. As for OpenSSL commands there are some, but I don’t have a cheat sheet or know them off the top of my head. I usually end up using Google and finding things to use. ---
**Author:** ![barryp](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@barryp](https://community.asterisk.org/u/barryp)\ **Post date:** [April 15, 2021, 3:53pm UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/8 "2021-04-15T15:53:07Z")
Thanks for your help. Is there any way i can command line OpenSSL function SSL\_CTX\_load\_verify\_locations to try and debug further ? The file is defintely in the location specifed, it is owned by asterisk and in the asterisk group. ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [April 15, 2021, 4:26pm UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/9 "2021-04-15T16:26:33Z")
I don’t know anything further about it. ---
**Author:** ![barryp](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@barryp](https://community.asterisk.org/u/barryp)\ **Post date:** [April 23, 2021, 11:00am UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/10 "2021-04-23T11:00:57Z")
Finally fixed this. Problem was with the permissions. This came from a colleague so don’t ask me to explain any further than the problem was Asterisk couldn’t access the certs in the directory. This is what they should be: ls -lZd /etc/asterisk/keys/ drwxr-x—. asterisk asterisk system\_u:object\_r:asterisk\_etc\_t:s0 /etc/asterisk/keys/ And these are the commands to set them to the above: chown -R asterisk.asterisk /etc/asterisk/keys/ chmod 750 /etc/asterisk/keys/ chcon -R -v -u system\_u -r object\_r -t asterisk\_etc\_t /etc/asterisk/keys/ Solved my problem ---
**Author:** ![david551](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@david551](https://community.asterisk.org/u/david551)\ **Post date:** [April 23, 2021, 11:07am UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/11 "2021-04-23T11:07:43Z")
In practice, most people will turn off SELinux, rather than using chcon to set the right context. Machines running Asterisk generally aren’t multiuser, so don’t need discretionary security. ---
**Author:** ![system](https://global.discourse-cdn.com/asterisk/original/2X/4/475d0c889911cfb84ac4881ad6df8b523e3f9105.png) [@system](https://community.asterisk.org/u/system)\ **Post date:** [May 23, 2021, 11:08am UTC](https://community.asterisk.org/t/asterisk-ca-certificate-path-error/88292/12 "2021-05-23T11:08:40Z")
Closed on May 23, 2021, 11:08am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.