[asterisk-dev] [Code Review] 4441: Enable TLS Dual-Certificates (ECC+RSA)

[Alexander Traud]

> On April 10, 2015, 5:45 p.m., rmudgett wrote:
> > trunk/main/tcptls.c, lines 841-858
> > <https://reviewboard.asterisk.org/r/4441/diff/2/?file=73366#file73366line841>
> >
> >     This is effectively the same code duplicated for ecc and dsa.  Make a subroutine that takes the variants as parameters:
> >     
> >     sub(cfg->certfile, certfile_len, "ecc", "ECC")
> >     
> >     Also the code is always attempting to use both cert files even if ecc works.

You can have up to three certificates as in Apache HTTP. For example, Symantec offers RSA+DSA+ECC via the product VeriSign Secure Site Pro. Some TLS implementations benefit even from DSA, for example SChannel on Windows XP requires DSA to use PFS. Therefore, the code attempts to load both: ECC and DSA.


- Alexander


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviewboard.asterisk.org/r/4441/#review15180
-----------------------------------------------------------


On April 13, 2015, 1:28 p.m., Alexander Traud wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviewboard.asterisk.org/r/4441/
> -----------------------------------------------------------
> 
> (Updated April 13, 2015, 1:28 p.m.)
> 
> 
> Review request for Asterisk Developers.
> 
> 
> Bugs: ASTERISK-24815
>     https://issues.asterisk.org/jira/browse/ASTERISK-24815
> 
> 
> Repository: Asterisk
> 
> 
> Description
> -------
> 
> Already works for Asterisk as the client. Enables dual- (or triple-) certificates for Asterisk as the TLS server. When a client connects via SSL/TLS, the server uses a RSA key-pair usually. However, more such algorithms exist like DSA and ECDSA. If you go for one of those, you would loose compatibility to RSA-only clients. This patch allows you to provide up-to one RSA, ECDSA and DSA key each (= one key or two keys or three keys). Copied over from the Apache HTTP server project, added in version 2.4.8.
> 
> Usage:
> tlscertfile=/etc/asterisk/example_rsa.pem
> Then, the code of this patch picks that path, filename, and searches for files called example_ecc.pem and example_dsa.pem automatically.
> 
> 
> Diffs
> -----
> 
>   trunk/main/tcptls.c 434385 
>   trunk/configs/samples/sip.conf.sample 428526 
> 
> Diff: https://reviewboard.asterisk.org/r/4441/diff/
> 
> 
> Testing
> -------
> 
> by developer, manually
> 
> This patch was tested in Ubuntu 14.04 LTS with a certificate from Comodo (ECC; chains-up to AddTrust and UTN) and RapidSSL (RSA; chains-up to GeoTrust and Equifax). TLS clients were CounterPath Bria (BlackBerry) and CSipSimple (Android). The test was done with OpenSSL 1.0.1 and OpenSSL 1.0.2. Both versions work as expected. However, if you use well-known (commercial) certificates, you might use different certificate chains. For this, you need at least OpenSSL 1.0.2. If you use your own certificate authority without a certificate chain, OpenSSL 1.0.1 is sufficient.
> 
> Because no new symbol of OpenSSL was used, I do not see a reason why this patch should not be compatible with older OpenSSL releases. Therefore, no if/def/version is introduced in this patch.
> 
> 
> Thanks,
> 
> Alexander Traud
> 
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20150413/b01fea3a/attachment-0001.html>