[SR-Users] Does Kamailio support ECDHE ciphers for TLS?

[AJ]

Hi, 

I have Kamailio 3.3.1 working fine with TLS 1.0, running on CentOS 6.3 

However, now I want to use some ECDHE ciphersuites, for instance:  ECDHE-ECDSA-AES128-SHA 
I have built an appropriate OpenSSL (1.0.0j) in CentOS to support this, and have generated the appropriate certs: 

openssl ecparam -out ca-privkey.pem -name secp256r1 -genkey -outform pem 
openssl req -x509 -new -key ca-privkey.pem -out ca_cert.pem -outform PEM -days 3650 
openssl ecparam -out privkey.pem -name secp256r1 -genkey -outform pem 
openssl req -new -nodes -key privkey.pem -outform pem -out cert_req.pem 
openssl ca -keyfile ca-privkey.pem  -cert ca_cert.pem -in cert_req.pem -out cert.pem 


However, when I try to connect from my phone I am always getting: 

Oct  3 20:27:54 /usr/sbin/kamailio[2905]: ERROR: tls [tls_server.c:1190]: TLS accept:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
Oct  3 20:27:54 /usr/sbin/kamailio[2905]: ERROR: <core> [tcp_read.c:1127]: ERROR: tcp_read_req: error reading 
If I use the OpenSSL s_server test-tool, I can connect from my phone just fine with these certs: 
openssl s_server -accept 8888 -cert cert.pem -key key.pem -pass stdin -CAfile calist.pem -cipher ECDHE-ECDSA-AES128-SHA 

Does Kamailio support ECDHE ciphersuites? 
If so, what am I doing wrong? 

Thanks! 
AJ 

[Daniel-Constantin Mierla]

Hello,

it should support all the ciphers from the library. Anyhow, you can
force a list through module parameter:

http://kamailio.org/docs/modules/stable/modules/tls.html#cipher_list

Also, be sure you don't have many versions of the ssl lib installed, or
if yes, then be sure you link against the right one.
Cheers,
Daniel

Post by AJ
Hi,
I have Kamailio 3.3.1 working fine with TLS 1.0, running on CentOS 6.3
However, now I want to use some ECDHE ciphersuites, for instance: ECDHE-ECDSA-AES128-SHA
openssl ecparam -out ca-privkey.pem -name secp256r1 -genkey -outform pem
openssl req -x509 -new -key ca-privkey.pem -out ca_cert.pem -outform PEM -days 3650
openssl ecparam -out privkey.pem -name secp256r1 -genkey -outform pem
openssl req -new -nodes -key privkey.pem -outform pem -out cert_req.pem
openssl ca -keyfile ca-privkey.pem -cert ca_cert.pem -in cert_req.pem -out cert.pem
Oct 3 20:27:54 /usr/sbin/kamailio[2905]: ERROR: tls [tls_server.c:1190]: TLS accept:error:1408A0C1:SSL routines:SSL3_GET_CLIENT_HELLO:no shared cipher
Oct 3 20:27:54 /usr/sbin/kamailio[2905]: ERROR: <core> [tcp_read.c:1127]: ERROR: tcp_read_req: error reading
openssl s_server -accept 8888 -cert cert.pem -key key.pem -pass stdin -CAfile calist.pem -cipher ECDHE-ECDSA-AES128-SHA
Does Kamailio support ECDHE ciphersuites?
If so, what am I doing wrong?
Thanks!
AJ
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users

[Amar Tuladhar]

Hi,

Can anybody help why 'BAD request' is sent for the Invite?

Thanks a lot
Amar


SeqNO: 22155, Time:2012-10-5 14:28:16, RECEIVED MSG FROM OTHERSS

Sender<-->Receiver:109.169.25.9:5060 <---> 103.10.31.251:5060

INVITE sip:***@103.10.31.251:5060 SIP/2.0

Max-Forwards: 69

From: "147963"
<sip:***@sip58.dial2dayplus.us>;tag=T-mDbiFHTcemPwtrCSksCpvl0mJ8HaI5

To: <sip:***@103.10.31.251:5060>

Call-ID: gx.R3nZ.4.1-N4oFwOqQ1zQ0SAj8vseQ

CSeq: 29171 INVITE

Allow:
PRACK,INVITE,ACK,BYE,CANCEL,UPDATE,SUBSCRIBE,NOTIFY,REFER,MESSAGE,OPTIONS

Session-Expires: 1800

Min-SE: 90

P-hint: outbound

Supported: timer

Via: SIP/2.0/UDP 109.169.25.9:5060;branch=z9hG4bK1349426396705

Contact: <sip:109.169.25.9:5060>

Expires: 300

Record-Route: <sip:109.169.25.9;lr=on>

Content-Type: application/sdp

Content-Length: 233



v=0

o=- 3558415916 3558415916 IN IP4 42.108.33.29

s=pjmedia

c=IN IP4 195.219.14.151

t=0 0

m=audio 21556 RTP/AVP 18 101

a=rtpmap:18 G729/8000

a=fmtp:18 annexb=no

a=sendrecv

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-15



SeqNO: 22156, Time:2012-10-5 14:28:16, SEND MSG TO OTHERSS

Sender<-->Receiver:103.10.31.251:5060 <---> 109.169.25.9:5060

SIP/2.0 400 Bad Request

Via: SIP/2.0/UDP 109.169.25.9:5060;branch=z9hG4bK1349426396705

CSeq: 29171 INVITE

From: "147963"
<sip:***@sip58.dial2dayplus.us>;tag=T-mDbiFHTcemPwtrCSksCpvl0mJ8HaI5

To: <sip:***@103.10.31.251:5060>;tag=8

X-ZTE-Cause: "SBC-5442"

Call-ID: gx.R3nZ.4.1-N4oFwOqQ1zQ0SAj8vseQ

Content-Length: 0