handle_tcptls_connection: FILE * open failed

Asterisk Asterisk Support
#1

I am using Asterisk 1.8.9.2 with Yealink T28P VoIP phones (latest v61 firmware)

I followed the instructions here:
wiki.asterisk.org/wiki/display/ … g+Tutorial
to enable TLS.

My sip.conf looks like this:
[general]
…
tlsenable = yes
tlscertfile = /etc/asterisk/certs/asterisk.pem
tlscadir = /etc/asterisk/certs/ca
tlscipher = ALL
tlsclientmethod = tlsv1

I have run “c_rehash” on the CA certs directory.

When the Yealink phones are set to TLS mode I get:
“handle_tcptls_connection: FILE * open failed” on the Asterisk CLI every minute or so.

I do not get this error when only using TLS to my upline provider.

I have spent a lot of time trying to work this out with Google and have had no success so far.

#2

try this:

ofps.oreilly.com/titles/97805965 … eConn.html

section is : Encrypting SIP calls

#3

[quote=“irakla7777777”]try this:

ofps.oreilly.com/titles/97805965 … eConn.html

section is : Encrypting SIP calls[/quote]

I have already done that procedure.

There is also another problem which I am going to have to resolve before continuing with the above, and that is, when TLS is switched On, outgoing calls can be made, but incoming calls can not. The phone’s status becomes “Unreachable” in “sip show peers”.

On the CLI I am getting the following message:
[Feb 17 11:47:13] ERROR[18793]: tcptls.c:397 ast_tcptls_client_start: Unable to connect SIP socket to 192.168.0.1:5063: Connection refused

How port 5063 relates to this I do not know. Port 5061 is the default for TLS:

"sip show settings"
Global Settings:

UDP Bindaddress: 0.0.0.0:5060
TCP SIP Bindaddress: Disabled
TLS SIP Bindaddress: 0.0.0.0:5061

The peer is as follows:
[DELETED]
type = friend
context = DELETED
host = dynamic
transport = tls
encryption = yes
username = DELETED
secret = DELETED
insecure = port,invite
nat = no
dtmfmode = rfc2833
canreinvite = no
disallow = all
allow = g722
qualify = yes
language=en_NZ

The phone is directly connected across the network to the Asterisk box.

#4

Your insecure parameter contains values that are no longer supported and when supported were more insecure than strictly necessary. canreinvite is deprecated.

I assume that port 5063 is the one from which the REGISTER was issued. I though you said that outgoing calls worked, as this error is for an outgoing call.

I’m also not sure that you need the insecurity of type=friend, here.

#5

[quote=“david55”]Your insecure parameter contains values that are no longer supported and when supported were more insecure than strictly necessary. canreinvite is deprecated.

I assume that port 5063 is the one from which the REGISTER was issued. I though you said that outgoing calls worked, as this error is for an outgoing call.

I’m also not sure that you need the insecurity of type=friend, here.[/quote]

I have now changed caneinvite=no to directmedia=no.

I am not sure how to deal with the other issue. By my reading type=friend is the only way to deal with VoIP phones on IP addresses that might change.