[asterisk-bugs] [JIRA] (ASTERISK-17727) [patch] TLS doesn't get all certificate chain

[Richard Mudgett (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-17727?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Richard Mudgett reassigned ASTERISK-17727:
------------------------------------------

    Assignee: Richard Mudgett
    
> [patch] TLS doesn't get all certificate chain
> ---------------------------------------------
>
>                 Key: ASTERISK-17727
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-17727
>             Project: Asterisk
>          Issue Type: Bug
>          Components: Channels/chan_sip/TCP-TLS
>    Affects Versions: 1.8.1
>            Reporter: LN
>            Assignee: Richard Mudgett
>            Severity: Minor
>         Attachments: documente_certificate_chain.patch, use_certificate_chain.patch
>
>
> Dear All, dear Digium,
> I use TLS on asterisk 1.8.1 with a cert file of trustwave.com CA root.
> I expected to load the certificate chain in the "tlscafile" (define in sip.conf) and the certificate released from the CA root in the "tlscertfile" (define in sip.conf).
> I see that the certificate chain is composed with the intermediate certificate of TrustWave CA (SecureTrust) and the root certificate of Entrust CA.
> So I copy the intermediate certificate of TrustWave CA in the tlscafile and append to that the root certificate of Entrust CA.
> Instead, I copy the certificate released form the CA in the tlscertfile.
> But after that, seems that asterisk read only the first certificate of the chain in the file tlscafile and doesn't read both certificate (intermediate cert of TrustWave and root cert of Entrust). So the general chain of the certificate (CA, intermediate cert and root cert) results UNTRUSTED.
> I think that this a bug.
> tlscafile 
> tlscertfile

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.asterisk.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira