Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

No Format
./ast_tls_cert -C pbx.mycompany.com -O "My Super Company" -d /etc/asterisk/keys -b 2048
  • The "-C" option is used to define our host - DNS name or our IP address.
  • The "-O" option defines our organizational name.
  • The "-d" option is the output directory of the keys.
  • The "-b" option specifies the size of the private key file, default is 1024 unless on master branch.
  1. You'll be asked to enter a pass phrase for /etc/asterisk/keys/ca.key, put in something that you'll remember for later.
  2. This will create the /etc/asterisk/keys/ca.crt file.
  3. You'll be asked to enter the pass phrase again, and then the /etc/asterisk/keys/asterisk.key file will be created.
  4. The /etc/asterisk/keys/asterisk.crt file will be automatically generated.
  5. You'll be asked to enter the pass phrase a third time, and the /etc/asterisk/keys/asterisk.pem will be created, a combination of the asterisk.key and asterisk.crt files.

...

No Format
./ast_tls_cert -m client -c /etc/asterisk/keys/ca.crt -k /etc/asterisk/keys/ca.key -C phone1.mycompany.com -O "My Super Company" -d /etc/asterisk/keys -o malcolm -b 2048
  • The "-m client" option tells the script that we want a client certificate, not a server certificate.
  • The "-c /etc/asterisk/keys/ca.crt" option specifies which Certificate Authority (ourselves) that we're using.
  • The "-k /etc/asterisk/keys/ca.key" provides the key for the above-defined Certificate Authority.
  • The "-C" option, since we're defining a client this time, is used to define the hostname or IP address of our SIP phone
  • The "-O" option defines our organizational name.
  • The "-d" option is the output directory of the keys."
  • The "-o" option is the name of the key we're outputting.
  • The "-b" option specifies the size of the private key file, default is 1024 unless on master branch.
  1. You'll be asked to enter the pass phrase from before to unlock /etc/asterisk/keys/ca.key.

...

No Format
tlsenable=yes
tlsbindaddr=0.0.0.0
tlscertfile=/etc/asterisk/keys/asterisk.pem
tlscafile=/etc/asterisk/keys/ca.crt
tlscipher=ALL

Here, we're enabling TLS support.
We're binding it to our local IPv4 wildcard (the port defaults to 5061 for TLS).
We've set the TLS certificate file to the one we created above.
We've set the Certificate Authority to the one we created above. TLS Ciphers have been set to ALL, since it's the most permissive.

Next, you'll need to configure a SIP peer within Asterisk to use TLS as a transport type. Here's an example:

...