From c45f8fa658f77bdf06b43b3f26116fc34b8415c3 Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Tue, 4 Feb 2014 18:06:44 +0000 Subject: [PATCH] tcptls.c: Made TLS handle a certificate chain file. Thanks to Guillaume Martres for doing the necessary research to validate the change. (closes issue ASTERISK-17727) Reported by: LN Patches: use_certificate_chain.patch (license #5864) patch uploaded by st documente_certificate_chain.patch (license #6576) patch uploaded by Guillaume Martres ........ Merged revisions 407272 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 407273 from http://svn.asterisk.org/svn/asterisk/branches/11 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/12@407274 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- configs/sip.conf.sample | 6 ++++-- main/tcptls.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/configs/sip.conf.sample b/configs/sip.conf.sample index 79daf003ec..d46d468fea 100644 --- a/configs/sip.conf.sample +++ b/configs/sip.conf.sample @@ -539,8 +539,10 @@ srvlookup=yes ; Enable DNS SRV lookups on outbound calls ; ;------------------------ TLS settings ------------------------------------------------------------ -;tlscertfile= ; Certificate file (*.pem format only) to use for TLS connections - ; default is to look for "asterisk.pem" in current directory +;tlscertfile= ; Certificate chain (*.pem format only) to use for TLS connections + ; The certificates must be sorted starting with the subject's certificate + ; and followed by intermediate CA certificates if applicable. + ; Default is to look for "asterisk.pem" in current directory ;tlsprivatekey= ; Private key file (*.pem format only) for TLS connections. ; If no tlsprivatekey is specified, tlscertfile is searched for diff --git a/main/tcptls.c b/main/tcptls.c index bfa3559859..e07f1f1a05 100644 --- a/main/tcptls.c +++ b/main/tcptls.c @@ -393,7 +393,7 @@ static int __ssl_setup(struct ast_tls_config *cfg, int client) if (!ast_strlen_zero(cfg->certfile)) { char *tmpprivate = ast_strlen_zero(cfg->pvtfile) ? cfg->certfile : cfg->pvtfile; - if (SSL_CTX_use_certificate_file(cfg->ssl_ctx, cfg->certfile, SSL_FILETYPE_PEM) == 0) { + if (SSL_CTX_use_certificate_chain_file(cfg->ssl_ctx, cfg->certfile) == 0) { if (!client) { /* Clients don't need a certificate, but if its setup we can use it */ ast_verb(0, "SSL error loading cert file. <%s>\n", cfg->certfile); -- 2.47.2