# Multiple CA certificates in Asterisk?

**URL:** <https://community.asterisk.org/t/multiple-ca-certificates-in-asterisk/49654>\
**Category:** Asterisk Support\
**Created:** [September 30, 2015, 2:29pm UTC](https://community.asterisk.org/t/multiple-ca-certificates-in-asterisk/49654 "2015-09-30T14:29:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leegethas](https://avatars.discourse-cdn.com/v4/letter/l/ebca7d/32.png) [@leegethas](https://community.asterisk.org/u/leegethas)\
**Post date:** [September 30, 2015, 2:29pm UTC](https://community.asterisk.org/t/multiple-ca-certificates-in-asterisk/49654/1 "2015-09-30T14:29:31Z")

</div>

Hi,

I have a direct link between two Asterisk-servers. This allows me to place direct and encrypted calls. I created my own certificates for this purpose and it works great! This is what the configuration looks like:

```auto
[general]
tlsenable=yes
tlsbindaddr=::
tlscertfile=/etc/asterisk/keys/asterisk.mycert.pem
tlscafile=/etc/asterisk/keys/mycacert.pem
tlscapath=/etc/asterisk/keys
tlscipher=TLSv1
tlsclientmethod=tlsv1

[otherside]
type=peer
host=asterisk.otherside.com
defaultuser=auser
secret=SuperSecret
context=incoming
transport=tls
```

As I said, this works perfect. No errors what-so-ever. Now I want to add another Asterisk-server. But that server uses a certificate that was not signed by my own CA-certificate. And it is also a certificate that those guys created with their own CA-file. It was not handed out by an official CA-authority. Just like my own. And as soon as I add their server, I get this error:

```auto
tcptls.c:621 handle_tcptls_connection: Certificate did not verify: self signed certificate in certificate chain
```

I tried importing their CA-certificate in /usr/local/share/ca-certifiactes/ and run update-ca-certificates. And sure enough, 1 new certificate was added. But I still get that error in Asterisk. Even after restarting Asterisk entirely.

I tried to comment tlscafile=/etc/asterisk/keys/mycacert.pem, while leaving tlscapath=/etc/asterisk/keys active, (hopefully) forcing Asterisk to use all keys in /etc/asterisk/keys/. That seemed to work, because my own certificate didn’t give any errors. But I still get errors on the other certificate.

How can I tell Asterisk it can trust that certificate?

---

<div class="post-metadata">

**Author:** ![leegethas](https://avatars.discourse-cdn.com/v4/letter/l/ebca7d/32.png) [@leegethas](https://community.asterisk.org/u/leegethas)\
**Post date:** [October 1, 2015, 9:24am UTC](https://community.asterisk.org/t/multiple-ca-certificates-in-asterisk/49654/2 "2015-10-01T09:24:08Z")

</div>

Ok, I’ve been doing some more Googeling on the subject and came across [this site](http://doxygen.asterisk.org/trunk/Config_sip.html). It says the following, regarding the option tlscapath= in sip.conf.

> [@](#):
>
> The files must be named with the CA subject name hash value.

But I’m not sure what that means… 😊

Could someone explain that to me?

---

<div class="post-metadata">

**Author:** ![leegethas](https://avatars.discourse-cdn.com/v4/letter/l/ebca7d/32.png) [@leegethas](https://community.asterisk.org/u/leegethas)\
**Post date:** [October 1, 2015, 1:36pm UTC](https://community.asterisk.org/t/multiple-ca-certificates-in-asterisk/49654/3 "2015-10-01T13:36:06Z")

</div>

Ok, I figured it out. For anyone running into the same problem, here’s how I fixed it.

[ul]First, you’ll need to get the hash value of the CA-cert file.[/ul]  
[ul]Than you need to rename the CA-cert file to the given hash-value, followed by a .0[/ul]  
[ul]And place that file in /etc/asterisk/keys/[/ul]

```auto
openssl x509 -in cacert.pem -noout -hash (let's say it's 5060a30f)
mv cacert.pem 5060a30f.0
mv 5060a30f.0 /etc/asterisk/keys/
```