I’m trying to get my first Stir/Shaken compliant incoming calls on a 20.7.0 instance.
When a call comes in, I’ve got the following (anonymized) output:
Cert ‘https://foo.com/bar.cer’ not trusted: unable to get local issuer certificate
I should add I have a very superficial understanding and practice of certificate and I may easily make noob mistakes.
During this failure, I could capture traffic. With Wireshark, I saw my machine downloaded something from foo.com domain.
On the same box, I could successfully run
cd /tmp
wget https://foo.com/bar.cer
file bar.cer
bar.cer: PEM certificate
Where did you get the cert? STIR/SHAKEN certs aren’t cheap and have to be issued by an authorized provider. Last I looked this was not something most people could remotely do.
You need to get the CA certificate that issued bar.cer and add that file to your stir_shaken.conf file under “verification”, “ca_file”. If you need to specify multiple CA certificates, place the certificates in a directory, run c_rehash in that directory, then add that directory to the “ca_path” parameter.
cd /tmp
openssl verify bar.cer
CN = SHAKEN FOOBAR, O = XXXX, C = FR
error 20 at 0 depth lookup: unable to get local issuer certificate
error bar.cer: verification failed
No, you can actually specify both. The certificate specified in ca_file and all the certificates in ca_path are combined into one list when verification is done.
In France you have to check against a centralized DB that the inbound call is signed by the right certificat. They use STIR/PASSporT with SHAKEN extension and call it MAN.
@tootai
How do you “check against a centralized DB that the inbound call is signed by the right certificate” ?
It seems to me that:
Asterisk already downloads the certificate which is pointed to by Identity header and somehow verify it
this is done independently of any dialplan statement if the related endpoint “stir_shaken_profile” specifies verification is required (endpoint_behavior=on or verify)
@gjoseph
Is it achievable yes or no, to do the following:
save the certificate which is pointed to by an Identity header of an incoming Stir/Shaken call, into a file
copy the file an other box on which OpenSSL is installed
download some other certificates, keys, whatever
issue an appropriate OpenSSL command that would print “the certificate is OK”
Asterisk already uses OpenSSL to verify the certificate. If you don’t have the CA certificate that issued the received certificate then it won’t verify no matter how you do it. The CAs certs are usually NOT in system certificate store so you have to get it from whoever sent you the call. If you want to examine the certificate retrieved from the URL in the Identity header yourself, they’re cached in /var/lib/asterisk/keys/stir_shaken. There’s nothing secret about the certificates so you can run openssl x509 -in <certfile> -text and post the result here.