PJSIP debug TLS issues with Wireshark

Asterisk Asterisk Support
1

Hello,
I have asterisk 13.14 server and endpoints connect through TLS on port 5061.
Every 1 hour the phones go offline for few seconds. Asterisk log shows extension unregister and few seconds later (2 to 15 seconds) extension is registered again.
Inspecting with wireshark shows some data exchange between phone (Grandstream GXP2130) and server, unfortunately encrypted.
I have the server private key, however asterisk is using Diffie-Hellman cipher and private key is not enough for decrypt.

Is it possible to log DH session key with asterisk?
How can i set weak non-DH just for debug?

2

A bit late but perhaps for those coming by an Internet search:

In chan_sip, you go for ‘tlscipher=AES128-SHA’ in the general section of your sip.conf.
In chan_pjsip, you go for ‘cipher = 0x002f’ in the TLS transport section(s) of your pjsip.conf.
That disables (EC)DHE. Then you add the path of your private key to Wireshark » Preferences » Protocols » SSL » Key list. There, I use ‘any’ for the IP address, ‘5061’ as port, and ‘sip.tcp’ as protocol.

1 Like