Asterisk 20 mTLS Failure Logging Patch
Budget: $30 – $250 USD
I'm seeking a developer to create a patch to be applied to the Asterisk 20 source code that's running PJSIP.
This patch will log instances where a phone connecting to the system presents a certificate that doesn't match our self-signed certificate, indicating a failure in mutual TLS (mTLS).
The primary purpose of this logging is for asterisk logging. The logs should be in plain text format and should only be recorded into the asterisk Logs. This will help me keep track of mTLS failures for security auditing purposes, without the need to enable asterisk debug.
Ideal skills and experience for this job include:
- Extensive knowledge of Asterisk and PJSIP
- Proficiency in patch development
- Experience with mTLS
Asterisk PJSIP should look like the following:
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
ca_list_file=/etc/asterisk/keys/ca.crt
cert_file=/etc/asterisk/keys/server.crt
priv_key_file=/etc/asterisk/keys/server.key
method=tlsv1_2
verify_client=yes
verify_server=yes
require_client_cert=yes
Where we have created the Self Signed Keys as follows (all placed in the /etc/asterisk/keys folder)
openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt
openssl x509 -noout -text -in ca.crt
openssl genrsa -out server.key 1024
openssl req -new -key server.key -out server.csr
openssl x509 -days 365 -CA ca.crt -CAkey ca.key -req -CAcreateserial -CAserial ca.srl -in server.csr -out server.crt
openssl x509 -text -in server.crt
openssl genrsa -out client.key 1024
openssl req -new -key client.key -out client.csr
openssl x509 -days 365 -CA ca.crt -CAkey ca.key -req -CAcreateserial -CAserial ca.srl -in client.csr -out client.crt
cat client.crt client.key > client.pem
The client.pem is loaded on yealink phones which it will use when connecting to the asterisk server.
This all works as expected, and the asterisk server does not allow the phone to negotiate if it is not using the certificate that we signed, likewise, it does allow through phones that are using our self signed certificate.
We need to have a log generated in the asterisk full file indicating:
WARNING: Certificate from peer '%s' did not verify: %s
This patch will log instances where a phone connecting to the system presents a certificate that doesn't match our self-signed certificate, indicating a failure in mutual TLS (mTLS).
The primary purpose of this logging is for asterisk logging. The logs should be in plain text format and should only be recorded into the asterisk Logs. This will help me keep track of mTLS failures for security auditing purposes, without the need to enable asterisk debug.
Ideal skills and experience for this job include:
- Extensive knowledge of Asterisk and PJSIP
- Proficiency in patch development
- Experience with mTLS
Asterisk PJSIP should look like the following:
[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
ca_list_file=/etc/asterisk/keys/ca.crt
cert_file=/etc/asterisk/keys/server.crt
priv_key_file=/etc/asterisk/keys/server.key
method=tlsv1_2
verify_client=yes
verify_server=yes
require_client_cert=yes
Where we have created the Self Signed Keys as follows (all placed in the /etc/asterisk/keys folder)
openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt
openssl x509 -noout -text -in ca.crt
openssl genrsa -out server.key 1024
openssl req -new -key server.key -out server.csr
openssl x509 -days 365 -CA ca.crt -CAkey ca.key -req -CAcreateserial -CAserial ca.srl -in server.csr -out server.crt
openssl x509 -text -in server.crt
openssl genrsa -out client.key 1024
openssl req -new -key client.key -out client.csr
openssl x509 -days 365 -CA ca.crt -CAkey ca.key -req -CAcreateserial -CAserial ca.srl -in client.csr -out client.crt
cat client.crt client.key > client.pem
The client.pem is loaded on yealink phones which it will use when connecting to the asterisk server.
This all works as expected, and the asterisk server does not allow the phone to negotiate if it is not using the certificate that we signed, likewise, it does allow through phones that are using our self signed certificate.
We need to have a log generated in the asterisk full file indicating:
WARNING: Certificate from peer '%s' did not verify: %s