From d06ec403aa0b158df0e551fd7a7486c2386b4171 Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Tue, 4 Feb 2014 17:50:04 +0000 Subject: [PATCH] tcptls.c: Made TLS handle a certificate chain file. Thanks to Guillaume Martres for doing the necessary research to validate the change. (closes issue ASTERISK-17727) Reported by: LN Patches: use_certificate_chain.patch (license #5864) patch uploaded by st documente_certificate_chain.patch (license #6576) patch uploaded by Guillaume Martres git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.8@407272 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- configs/sip.conf.sample | 6 ++++-- main/tcptls.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/configs/sip.conf.sample b/configs/sip.conf.sample index e977e234fc..cd12029bdc 100644 --- a/configs/sip.conf.sample +++ b/configs/sip.conf.sample @@ -474,8 +474,10 @@ srvlookup=yes ; Enable DNS SRV lookups on outbound calls ; Set to yes add Reason header and use Reason header if it is available. ; ;------------------------ TLS settings ------------------------------------------------------------ -;tlscertfile= ; Certificate file (*.pem format only) to use for TLS connections - ; default is to look for "asterisk.pem" in current directory +;tlscertfile= ; Certificate chain (*.pem format only) to use for TLS connections + ; The certificates must be sorted starting with the subject's certificate + ; and followed by intermediate CA certificates if applicable. + ; Default is to look for "asterisk.pem" in current directory ;tlsprivatekey= ; Private key file (*.pem format only) for TLS connections. ; If no tlsprivatekey is specified, tlscertfile is searched for diff --git a/main/tcptls.c b/main/tcptls.c index e6feec8133..47041fea86 100644 --- a/main/tcptls.c +++ b/main/tcptls.c @@ -384,7 +384,7 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client) if (!ast_strlen_zero(cfg->certfile)) { char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile; - if (SSL_CTX_use_certificate_file(cfg->ssl_ctx, cfg->certfile, SSL_FILETYPE_PEM) == 0) { + if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cfg->certfile) == 0) { if (!client) { /* Clients don't need a certificate, but if its setup we can use it */ ast_verb(0, "SSL error loading cert file. <%s>", cfg->certfile); -- 2.47.3