多网TLS配置说明
1. 步骤
若有两网，一个内网（AAA.BBB.C.DDD:5061），一个外网（AAA.BBB.C.DDD:50001 as KKK.EEE.F.GGG:50001）
1.1 创建rootCA
输入如下命令创建rootCA
opensipsctl tls rootCA
输入密码为opensips
1.2 创建多外网TLS证书
① 进入/usr/etc/opensips/tls/目录
② 创建AAA.BBB.C.DDD:5061的证书
cp user.conf pub-sip-server.conf //拷贝一个模板
编辑pub-sip-server.conf
更改字段commonName = AAA.BBB.C.DDD:5061
其他字段视情况更改
输入如下命令生成证书
opensipsctl tls userCERT pub-sip-server
会生成一个pub-sip-server文件夹，里面包含一些证书
③ 创建KKK.EEE.F.GGG:50001的证书
同2，只不过commonName = KKK.EEE.F.GGG:50001
假设其生成的证书在ex-pub-sip-server目录下
④ 在TLS根目录汇总多证书
cat pub-sip-server/pub-sip-server-cert.pem >> cert.pem
cat pub-sip-server/pub-sip-server-privkey.pem >> priv.pem
cat pub-sip-server/pub-sip-server-calist.pem >> calist.pem
cat ex-pub-sip-server/ex-pub-sip-server-cert.pem >> cert.pem
cat ex-pub-sip-server/ex-pub-sip-server-privkey.pem >> priv.pem
cat ex-pub-sip-server/ex-pub-sip-server-calist.pem >> calist.pem
2. opensips.cfg中TLS配置如下
disable_tls = no
listen = tls:AAA.BBB.C.DDD:5061
listen = tls:AAA.BBB.C.DDD:50001 as KKK.EEE.F.GGG:50001
tls_verify_server = 1
tls_verify_client = 0
tls_require_client_certificate = 0
tls_method = TLSv1
tls_ciphers_list="NULL"
tls_certificate = "/usr/etc/opensips/tls/cert.pem"
tls_private_key = "/usr/etc/opensips/tls/priv.pem"
tls_ca_list = "/usr/etc/opensips/tls/calist.pem"
tls_server_domain[AAA.BBB.C.DDD:5061]{
tls_certificate =
"/usr/etc/opensips/tls/pub-sip-server/pub-sip-server-cert.pem"
tls_private_key =
"/usr/etc/opensips/tls/pub-sip-server/pub-sip-server-privkey.pem"
tls_ca_list =
"/usr/etc/opensips/tls/pub-sip-server/pub-sip-server-calist.pem"
#tls_verify_server = 1
tls_verify_client = 0
tls_require_client_certificate = 0
tls_method = TLSv1
}
tls_server_domain[AAA.BBB.C.DDD:50001]{
#tls_verify_server = 1
tls_verify_client = 0
tls_require_client_certificate = 0
tls_method = TLSv1
tls_certificate =
"/usr/etc/opensips/tls/ex-pub-sip-server/ex-pub-sip-server-cert.pem"
tls_private_key =
"/usr/etc/opensips/tls/ex-pub-sip-server/ex-pub-sip-server-privkey.pem"
tls_ca_list =
"/usr/etc/opensips/tls/ex-pub-sip-server/ex-pub-sip-server-calist.pem"
}
加载中，请稍候......
加载中…