hi guys, happy OpenSER's 1st Anniversary and happy world cup! I configure the TLS on OpenSER-1.0.1 release, but it doesn't work well. i searched on the web and found the discussion (attach it below) which posted monthes ago, my problem is very similar to it. but i can't find any conclusion about this discussion. Does anyone has resolved the similar problem, can you share the experiences? thanks in advance. my openssl's version is 0.9.8a when used snom360 to connect openser via tls, it blocked and freezed after receive ServerHelloDone. windows messenger 5.1 can go further, but still popup the "There was a problem verifying the certificate..." msg. and openser print the error are SSL_ERROR_WANT_READ and SSL_ERROR_SYSCALL... my certificate should be right, i have checked and regenerated it heaps of times... ---------------------------------------- [prev in list] [next in list] [prev in thread] [next in thread] List: voipsec Subject: Re: [VOIPSEC] Snom Softphone with TLS and Openser From: dennis <m8939605 () yahoo ! com ! tw> Date: 2006-02-24 13:44:01 Message-ID: 20060224134401.62975.qmail () web17506 ! mail ! tpe ! yahoo ! com [Download message RAW] Hi Martin, I folllow your method, but I still have somme problem. 1.After receive ClientHello, openser will be terminated. my openser is 1.0.0 1 1 0.0023 (0.0023) C>S Handshake ClientHello Version 3.1 cipher suites TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_NULL_MD5 TLS_RSA_WITH_NULL_SHA TLS_DH_anon_WITH_3DES_EDE_CBC_SHA TLS_DH_anon_WITH_RC4_128_MD5 TLS_RSA_WITH_DES_CBC_SHA TLS_RSA_EXPORT1024_WITH_RC4_56_SHA TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA TLS_DH_anon_WITH_DES_CBC_SHA compression methods NULL 1 0.2734 (0.2710) S>C TCP FIN /////////////////////////////////// 2. Add the tls_ciphers_list="NULL-SHA:NULL-MD5", openser was ok, but snom soft phone was stuck immediately after starting and did not accept any input via the user interface. 1 1 0.0894 (0.0894) C>S Handshake ClientHello Version 3.1 cipher suites TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_NULL_MD5 TLS_RSA_WITH_NULL_SHA TLS_DH_anon_WITH_3DES_EDE_CBC_SHA TLS_DH_anon_WITH_RC4_128_MD5 TLS_RSA_WITH_DES_CBC_SHA TLS_RSA_EXPORT1024_WITH_RC4_56_SHA TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA TLS_DH_anon_WITH_DES_CBC_SHA compression methods NULL 1 2 0.0913 (0.0018) S>C Handshake ServerHello Version 3.1 session_id[32]= 86 63 02 13 cd 51 12 d8 02 61 aa cc 66 63 84 d8 21 42 01 8e c1 d6 8e b0 c3 b6 d1 26 68 73 0d 02 cipherSuite TLS_RSA_WITH_NULL_MD5 compressionMethod NULL 1 3 0.0913 (0.0000) S>C Handshake Certificate 1 4 0.0913 (0.0000) S>C Handshake ServerHelloDone 1 131.0737 (130.9823) S>C TCP FIN When you re-executed the program, the ceritificate will be clean away. I thought that the soft phone lost it's certificate, so it hang on. Another root causer may be openssl (0.97f), I will try to upgrade or reinstall it. /////////////////////////////////////// In my environment, Windows Messenger always has some problems with Openser, when openser sent certificate, WM always pop up a error messange. 3 1 0.8193 (0.8193) C>S Handshake ClientHello Version 3.1 cipher suites TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA TLS_RSA_EXPORT1024_WITH_RC4_56_SHA TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA TLS_RSA_EXPORT_WITH_RC4_40_MD5 TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA compression methods NULL 3 2 0.8199 (0.0006) S>C Handshake ServerHello Version 3.1 session_id[32]= c3 b3 f1 16 de e4 76 d6 97 e3 ae ba 68 06 31 92 1a 5c 62 c7 f5 8c 7d 2c 2e 2b 87 47 32 a6 04 32 cipherSuite TLS_RSA_WITH_3DES_EDE_CBC_SHA compressionMethod NULL 3 3 0.8199 (0.0000) S>C Handshake Certificate 3 4 0.8199 (0.0000) S>C Handshake ServerHelloDone //////////////////////////////////// But after replaced key size from 2048 to 1024, there was improvement in Windows Messenger, although it still pop up the same error. 3 1 0.8193 (0.8193) C>S Handshake ClientHello Version 3.1 cipher suites TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA TLS_RSA_EXPORT1024_WITH_RC4_56_SHA TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA TLS_RSA_EXPORT_WITH_RC4_40_MD5 TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA compression methods NULL 3 2 0.8199 (0.0006) S>C Handshake ServerHello Version 3.1 session_id[32]= c3 b3 f1 16 de e4 76 d6 97 e3 ae ba 68 06 31 92 1a 5c 62 c7 f5 8c 7d 2c 2e 2b 87 47 32 a6 04 32 cipherSuite TLS_RSA_WITH_3DES_EDE_CBC_SHA compressionMethod NULL 3 3 0.8199 (0.0000) S>C Handshake Certificate 3 4 0.8199 (0.0000) S>C Handshake ServerHelloDone 3 5 0.8701 (0.0501) C>S Handshake ClientKeyExchange 3 6 0.8701 (0.0000) C>S ChangeCipherSpec 3 7 0.8701 (0.0000) C>S Handshake 3 8 0.8736 (0.0035) S>C ChangeCipherSpec 3 9 0.8738 (0.0001) S>C Handshake 3 1.6979 (0.8241) C>S TCP FIN 3 10 1.6985 (0.0006) S>C Alert 3 1.6986 (0.0000) S>C TCP FIN The Alert was not a standard TLS alert description, so I can't analyze it. The Alter messange is below: 15 03 01 00 18 fe ef bc 84 a3 c7 8c 8c a5 91 e7 da e1 7c ^^^^^^^^ (there are some problems.....) 06 ee 35 9d 32 21 ec ef 8c 79 --- Christian Stredicke &lt;Christian.Stredicke(a)snom.de&gt; ���G http://voipsa.org/mailman/listinfo/voipsec_voipsa.org http://voipsa.org/mailman/listinfo/voipsec_voipsa.org