...
If both proxies have enabled TLS and clients let you add the sips: "prefix" you don't need to add special routing logic to cfg. Even if client itself does'n use TLS it can work (EyeBeam - TCP – > OB SER – TLS – >SER – ?? - > client)
Remember that TLS is done only on hop by hop basis.
To be sure or to define tls peers you need to do following:
| Note | ||||
|---|---|---|---|---|
| ||||
If encryption of the SIP messages is enough for you and no mutual verification of the servers is necessary, you can change: |
OpenSER proxy configuration:
...
Validation, confirmation tests
- register a UA at the proxy of domainA
- register a UA at the proxy of domainB
- make a call from UA 'A' to UA 'B' and see if it succeeds
- check in the UA and proxy logging whether TLS was used (and there was no fallback to UDP)
OS specific help
Reminder: this example is based on a compiled version of openSER where the config is in /usr/local/etc/openser and the certificates are in /usr/local/etc/openser/tls/user, which might differ when installed from packages.