[asterisk-bugs] [JIRA] (ASTERISK-17727) [patch] TLS doesn't get all certificate chain

[Matt Jordan (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-17727?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matt Jordan updated ASTERISK-17727:
-----------------------------------

    Target Release Version/s: 1.8.27.0

> [patch] TLS doesn't get all certificate chain
> ---------------------------------------------
>
>                 Key: ASTERISK-17727
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-17727
>             Project: Asterisk
>          Issue Type: Bug
>          Components: Channels/chan_sip/TCP-TLS
>    Affects Versions: 1.8.1
>            Reporter: LN
>            Assignee: Richard Mudgett
>            Severity: Minor
>      Target Release: 1.8.27.0, 12.1.0
>
>         Attachments: documente_certificate_chain.patch, use_certificate_chain.patch
>
>
> Dear All, dear Digium,
> I use TLS on asterisk 1.8.1 with a cert file of trustwave.com CA root.
> I expected to load the certificate chain in the "tlscafile" (define in sip.conf) and the certificate released from the CA root in the "tlscertfile" (define in sip.conf).
> I see that the certificate chain is composed with the intermediate certificate of TrustWave CA (SecureTrust) and the root certificate of Entrust CA.
> So I copy the intermediate certificate of TrustWave CA in the tlscafile and append to that the root certificate of Entrust CA.
> Instead, I copy the certificate released form the CA in the tlscertfile.
> But after that, seems that asterisk read only the first certificate of the chain in the file tlscafile and doesn't read both certificate (intermediate cert of TrustWave and root cert of Entrust). So the general chain of the certificate (CA, intermediate cert and root cert) results UNTRUSTED.
> I think that this a bug.
> tlscafile 
> tlscertfile



--
This message was sent by Atlassian JIRA
(v6.2#6252)