Call processor setup

Kamailio configuration

You need to create a /etc/kamailio/tls.cfg configuration file; for reference, see here.

Enable kamailio tls with:

echo '#!define WITH_TLS' >> /etc/kamailio/kamailio-local.cfg

Restart kamailio with:

systemctl restart kamailio

Check kamailio is active:

systemctl status kamailio

Media processor setup

Asterisk configuration

Create a directory to store keys and certificates.

mkdir /etc/asterisk/keys

Download the asterisk helper script for certificate generation from here and save it to /usr/local/bin/ast_tls_cert on the Media processor node.

Run it to generate the required certificate (you will be asked for a passphrase several times during the process):

/usr/local/bin/ast_tls_cert -C <ipaddress of media processor> -O "My Company" -d /etc/asterisk/keys -b 2048

Make sure all files are owned by the asterisk user with:

chown asterisk.asterisk -R /etc/asterisk/keys

Add a section in /etc/asterisk/pjsip.conf for tls:

[transport-tls]
type=transport
protocol=tls
bind=0.0.0.0:5061
cert_file=/etc/asterisk/keys/asterisk.crt
priv_key_file=/etc/asterisk/keys/asterisk.key
method=sslv23

In the SRE endpoint configuration section in /etc/asterisk/pjsip.conf, add the media_encryption setting:

[SRE]
type=endpoint
context=from-external
disallow=all
allow=alaw,ulaw
media_encryption=sdes

You can choose a different method; see the asterisk configuration here.

Restart asterisk with:

systemctl restart asterisk

Check asterisk is active with:

systemctl status asterisk

The chosen media_encryption setting must also be present in /opt/sre/etc/sre.cfg in the asterisk section like this:

[asterisk]
...
media_encryption=sdes

Restart the media-processor process to re-read the setting:

/opt/sre/bin/supervisorctl restart sre-media-processor

GUI configuration

SIP-agent status via TLS

To check the health status of a TLS endpoint, on the System->SIP agents monitoring page, make sure the protocol is set to TLS.

Service logic peculiarities

Relay to Media node

If you need to encrypt calls between Call processor and Media proccessor, when using the relay to media node, use the following entry for destination: [address]:5061;trasport=tls.

TIP

[address] is expanded by the node; you should not put an actual address here.

Media originate call node

If you need to originate calls to TLS endpoints, set Call target to something like +12345@host:port;transport=tls.

Troubleshooting

Media processor node

You can connect to the asterisk instance with:

asterisk -rvvv

At the CLI prompt, enter this command to see all SIP packets in clear:

CLI> pjsip set logger on