How to Configure TLS with SIP Proxy

This article provides steps to configure SIP with TLS encryption in an example scenario where the telephone is located in a different network from that of the PBX. The Barracuda CloudGen Firewall performs NAT between both networks. The SIP proxy in the CloudGen Firewall translates the network addresses in SIP messages to allow communication between the telephone and the PBX. The example scenario is illustrated in the following diagram:

Open

For more security, configure all peers to verify the validity of the certificates and provide their own custom certificates. You can configure the peers not to verify the certificates, but this is a less secure setup. If you are testing TLS, it is recommended that you test the scenario with the highest security because it is less fault-tolerant and more likely to produce problems in case of misconfiguration.

• You must install OpenSSL to create a self-signed CA and the certificates. OpenSSL is already installed in most Linux distributions. In Windows, you must install it separately.

• This article provides steps for creating a self-signed root CA. If you disable the use of an external CA in the SIP proxy, an internal root CA is generated automatically. You can use this root CA to sign the certificates for the client and the PBX instead of creating another one. The root CA environment is located in  /var/phion/preserve/sipsprx/server_service/opensips/rootCA/. 

• This article provides steps for use with PhonerLite and Asterisk, but you can use any softphone or PBX that supports TLS encryption. The configuration of Asterisk, except for the TLS settings, as well as the standard configuration of the SIP proxy are out of the scope of this article. An already working setup with SIP over UDP or TCP is assumed.

Create an App Redirect firewall rule to redirect the SIP port to the SIP proxy. 

• If you have specified SIPcf as the Service, edit the SIPcf Service Object to add TCP port 5061.

• If you explicitly specified the ports in your redirect rule, add TCP port 5061 so that it is also redirected.

Open

Create the private keys and certificates for the softphone, SIP proxy, and PBX .

For more information on how to create self-signed X.509 certificates, see How to Create Certificates with XCA and How to Create Certificates for the SIP Proxy.

To configure the TLS settings for the SIP proxy:

1. Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > Firewall > Forwarding Settings.

2. In the left menu, select VoIP/SIP.

3. Expand the Configuration Mode menu and click Switch to Advanced.

4. Click Lock.

5. In the SIP Proxy TLS Settings section, select the Enable TLS Support check box. 
   

       

6. Next to Private Key, click Ex/Import, select Import from File, and then select the sipproxy-private.pem file that you generated. 

7. Select the Use an External CA check box.

8. Next to External Root CA Certificate, click Ex/Import and select Import from PEM File.

9. Browse to the rootCA folder and select the cacert.pem file.

10. In SIP Proxy Certificate, import the sipproxy-cert.pem file in the tls folder.

    It is recommended that you change the Certificate Security Level to High. This setting provides protection from man-in-the-middle attacks by requiring the SIP proxy to check the validity of the certificates from the client and the server. If the certificates are invalid, they are rejected.

11. Click Send Changes and Activate.

12. To verify that the certificate file was accepted, view the log file of the SIP proxy (Server \ FirewallService \sipproxy). The file should look similar to the following:

    INFO:core:check_for_krb: KRB5 cipher KRB5-DES-CBC3-MD5 found INFO:core:init_tls_domains: Processing TLS domain [0.0.0.0:0] WARNING:core:init_ssl_ctx_behavior: client verification NOT activated. Weaker security. INFO:core:init_tls_domains: Processing TLS domain [0.0.0.0:0] WARNING:core:init_ssl_ctx_behavior: server verification NOT activated. Weaker security. NOTICE:core:main: version: opensips 1.8.2-tls (x86_64/linux)

To configure TLS settings for the Asterisk server:

1. Connect to the Asterisk server through SSH.

2. Change to the /etc/asterisk directory and create a subdirectory named tls.

3. Copy the following files into the /etc/asterisk/tls directory:

   • The cacert.pem file from your rootCA folder.

   • The asterisk-keycert.pem file from your tls folder.

4. Change the user and group of /etc/asterisk/tls and all of its contents to the same user Asterisk uses. Then, change the permissions of both files to 0400. 
   $ cd /etc/asterisk 
$ chown -R asterisk:asterisk tls/ 
$  chmod 0400 /etc/asterisk/tls/*

5. If you are using FreePBX, open the /etc/asterisk/sip_general_custom.conf file with a text editor such as vi.

6. If you are not using FreePBX, open the /etc/asterisk/sip.conf file with a text editor such as vi and search for the [general] section.

7. Add the following lines:

   tlsenable=yes tlsbindaddr=0.0.0.0 tlscertfile=/etc/asterisk/tls/asterisk-keycert.pem tlsdontverifyserver=no ;tlscipher=DES-CBC3-SHA tlsclientmethod=sslv23 tlscafile=/etc/asterisk/tls/cacert.pem

   If you do not want Asterisk to verify the validity of the certificates, set tlsdontverifyserver to yes .

8. Change the transport protocol of your SIP peers to TLS:

   1. Open FreePBX and select Applications > Extensions.

   2. Edit each of your extensions. 

      • If you only want to allow your SIP peers to use TLS (which is more secure but breaks the standard), set the transport parameter to TLS Only.

      • If you want to allow (but not force) TLS, set it to All – TLS Primary.

9. Apply the changes in FreePBX to reload the configuration.

10. To verify that the certificate was correctly configured:

    1. Connect to the Asterisk CLI.
       $ asterisk -r

    2. Reload the configuration. 
       $ sip reload 
       If the certificate was correctly configured, Asterisk displays the following message:
       SSL certificate ok.

You must import the root CA certificate that you have created in the previous configuration. Otherwise, the client will reject the certificate of the server. To import the root CA into the client:

1. In Windows, click the Start menu and type mmc in the search field. 

2. When the mmc program appears, click it.

3. Go to File > Add/Remove Snap-in.

4. In the Add/Remove Snap-in window, click Certificates from the list of available snap-ins and then click Add.

5. In the Certificates Snap-in window, select Computer account, click Next, and then click Finish.

6. Click OK.

7. In the Console window, expand Certificates (Local Computer) in the left pane.

8. Right-click Trusted Root Certification Authorities and select All Tasks > Import.

9. In the Certificate Import Wizard, click Next, click Browse, and then select the cacert.pem file from the rootCA folder. If you do not see the cacert.pem file, change the file filter to All Files (*.*).
   

10. Click Next and then click Finish.