# SSL problems (Handshake) **URL:** \ **Category:** Asterisk SIP\ **Created:** [September 10, 2019, 4:36pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838 "2019-09-10T16:36:41Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![dyoser](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dyoser](https://community.asterisk.org/u/dyoser)\ **Post date:** [September 10, 2019, 4:36pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/1 "2019-09-10T16:36:41Z")
Hello i’m trying to give acces via wss to Odoo and i think i’ve everythin up & running except the cert problems. Steps i follow : 1. Tutorial from asterisk to setup tls/wss 2. Create certificates with the ast\_tls\_cert and having the .pem .crt .key files **[pjsip.conf]** ```auto [transport-tls] type=transport protocol=tls bind=0.0.0.0:5061 cert_file=/etc/asterisk/keys/asterisk.crt priv_key_file=/etc/asterisk/keys/asterisk.key cipher=ADH-AES128-SHA256 method=tlsv1 ``` **[http.conf]** ```auto servername=Asterisk enabled=Yes bindaddr=0.0.0.0 bindport=8088 tlsenable=yes ; enable tls - default no. tlsbindaddr=192.168.1.227:8089 ; address and port to bind to - default is bindaddr and port 8089. ;tlsdontverifyserver=yes tlscertfile=/etc/asterisk/keys/asterisk.pem ; path to the certificate file (*.pem) only. ;tlscafile=/etc/asterisk/keys/asterisk.crt ;tlsprivatekey=/etc/asterisk/keys/asterisk_key.pem ; path to private key file (*.pem) only. ;tlsprivatekey=/etc/asterisk/keys/ca.pem ``` Here the tutorial seems to be not very clear as it requires in the key private a .pem file but the script does not create one. Am i missing something there? And when trying to connect through [https://www.websocket.org/echo.html](https://www.websocket.org/echo.html) using wss://\:5061/ws i’m getting in the console this errors **WARNING[21949]: pjproject: \: | SSL SSL\_ERROR\_SSL (Handshake): Level: 0 err: \<337625269\> len: 0 peer: 192.168.1.1:47932|** **|—|---|** **WARNING[21949]: pjproject: \: | SSL SSL\_ERROR\_SSL (Handshake): Level: 0 err: \<337625269\> len: 0 peer: 192.168.1.1:47934|** Also my local chrome have connection to it… ![websocket-asterisk](https://global.discourse-cdn.com/asterisk/original/2X/5/5556a8dbe71890643776b9a4714b810f772fedcc.png) The error shown when i try an external connection: ![asterisk-handshake-error](https://global.discourse-cdn.com/asterisk/original/2X/4/4413f5e714bf76b1e204d275df0256ef9f38ebac.png) Can someone helps me with this? Regards ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [September 10, 2019, 5:02pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/2 "2019-09-10T17:02:01Z")
In your echo attempt you were using port 5061 instead of 8089. You can’t connect to port 5061 as that is for SIP TLS, not HTTPS Websocket. ---
**Author:** ![dyoser](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dyoser](https://community.asterisk.org/u/dyoser)\ **Post date:** [September 10, 2019, 5:08pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/3 "2019-09-10T17:08:50Z")
But if i change to port 8089, i’ve no answer to my asterisk. Can you point me out what i’m doing wrong? Thanks ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [September 10, 2019, 5:09pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/4 "2019-09-10T17:09:50Z")
You’ll need to be more specific about what exactly you are wanting to do, what you’ve tried, and what you are expecting. ---
**Author:** ![dyoser](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dyoser](https://community.asterisk.org/u/dyoser)\ **Post date:** [September 10, 2019, 5:14pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/5 "2019-09-10T17:14:32Z")
I’m trying to connect Odoo which uses a wss://\:\<\_port\>/ws to connect to asterisk, but with no luck. Internally everything works fine with calling extensions and also external connections with 3cx softphones to asterisk. I think that my mistake is about the ssl certificates as i pointed above with the 2 .pem files required ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [September 10, 2019, 5:15pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/6 "2019-09-10T17:15:43Z")
Is the certificate self signed? Does Odoo allow self signed certificates? What does it say when you try? Did you use the 8089 port and address? I should also add that I don’t believe Odoo has ever been tested against Asterisk over websockets. ---
**Author:** ![dyoser](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dyoser](https://community.asterisk.org/u/dyoser)\ **Post date:** [September 10, 2019, 5:18pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/7 "2019-09-10T17:18:25Z")
i create them following [https://wiki.asterisk.org/wiki/display/AST/Configuring+Asterisk+for+WebRTC+Clients](https://wiki.asterisk.org/wiki/display/AST/Configuring+Asterisk+for+WebRTC+Clients) To test the connection to wss://…/ws i use [https://www.websocket.org/echo.html](https://www.websocket.org/echo.html) with the port 8089 but no reply from asterisk. If i change to 5061 the console replies with the handshake error. ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [September 10, 2019, 5:19pm UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/8 "2019-09-10T17:19:22Z")
On connection Asterisk wouldn’t send anything. If it connected, then the websocket was successfully established. ---
**Author:** ![dyoser](https://avatars.discourse-cdn.com/v4/letter/d/71e660/32.png) [@dyoser](https://community.asterisk.org/u/dyoser)\ **Post date:** [September 12, 2019, 9:49am UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/9 "2019-09-12T09:49:39Z")
Thanks for your reply jcolp. Answering your questions : Is the certificate self signed? **The certificate is self signed, yes** Does Odoo allow self signed certificates? **It does** Did you use the 8089 port and address? Yes i did, and this is the reply when i try it. ERROR[21323]: tcptls.c:157 handle\_tcptls\_connection: Unable to set up ssl connection with peer '\:18994 iostream.c:538 ast\_iostream\_close: SSL\_shutdown() failed: error:00000001:lib(0):func(0):reason(1), Internal SSL error ERROR[21324]: iostream.c:633 ast\_iostream\_start\_tls: Problem setting up ssl connection: error:00000001:lib(0):func(0):reason(1), Internal SSL ---
**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\ **Post date:** [September 12, 2019, 9:56am UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/10 "2019-09-12T09:56:51Z")
What TLS version does Odoo support? What ciphers? Does it give you any indication of a problem? What version of OpenSSL is in use? ---
**Author:** ![system](https://global.discourse-cdn.com/asterisk/original/2X/4/475d0c889911cfb84ac4881ad6df8b523e3f9105.png) [@system](https://community.asterisk.org/u/system)\ **Post date:** [October 12, 2019, 9:56am UTC](https://community.asterisk.org/t/ssl-problems-handshake/80838/11 "2019-10-12T09:56:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.