| 00:23.46 | *** join/#asterisk CatCow97 (~mine9@c-73-96-109-206.hsd1.or.comcast.net) |
| 00:41.08 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 01:43.33 | *** join/#asterisk spatel (~spatel@pool-96-237-230-175.bstnma.fios.verizon.net) |
| 02:22.29 | *** join/#asterisk hfb (~hfb@cpe-172-117-13-65.socal.res.rr.com) |
| 03:01.18 | *** join/#asterisk opal (~wowaname@volatile/founder/wowaname) |
| 03:01.52 | *** join/#asterisk yokel (~yokel@unaffiliated/contempt) |
| 03:04.44 | *** join/#asterisk Typhon (~Typhon@dslb-088-066-011-198.088.066.pools.vodafone-ip.de) |
| 03:07.04 | *** join/#asterisk stux16777216Away (stux2@grid9.quadspeedi.net) |
| 04:09.06 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 04:17.29 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 04:20.32 | *** join/#asterisk FH_thecat (~FH_thecat@75.11.25.212.ftth.as8758.net) |
| 04:41.32 | *** join/#asterisk nickvsnetworking (~nickvsnet@103.31.113.82) |
| 04:52.39 | *** join/#asterisk nickvsnetworking (~nickvsnet@103.31.113.82) |
| 04:53.52 | *** join/#asterisk opal (~wowaname@volatile/founder/wowaname) |
| 05:23.04 | *** join/#asterisk gerhard7 (~gerhard7@ip5657ee30.direct-adsl.nl) |
| 05:29.34 | *** join/#asterisk nickvsnetworking (~nickvsnet@103.31.113.82) |
| 05:39.15 | *** join/#asterisk tomaluca95 (~quassel@kde/developer/tomaluca) |
| 05:59.36 | *** join/#asterisk robink (~quassel@unaffilated/robink) |
| 06:11.23 | *** join/#asterisk fstd_ (~fstd@unaffiliated/fisted) |
| 07:10.55 | *** join/#asterisk sa02irc (~mbax@155-079-043-212.ip-addr.inexio.net) |
| 07:15.41 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 08:08.55 | *** join/#asterisk nickvsnetworking (~nickvsnet@103.31.113.82) |
| 08:24.38 | *** join/#asterisk miralin (~Thunderbi@178.34.161.83) |
| 08:25.54 | *** join/#asterisk miralin1 (~Thunderbi@178.34.161.83) |
| 08:34.15 | *** join/#asterisk miralin1 (~Thunderbi@195.209.246.194) |
| 09:43.00 | *** join/#asterisk velix (~velix@unaffiliated/velix) |
| 09:44.00 | velix | I often see container guys adding edge repository to 3.11 and just installing packages from there. Why does this work? Or is it just luck? |
| 09:52.54 | velix | oops, wrong channel ;) |
| 09:52.59 | *** part/#asterisk velix (~velix@unaffiliated/velix) |
| 10:08.21 | *** join/#asterisk pchero_work (~pchero@2a02:a210:2241:6480:6c35:28cc:a369:1814) |
| 10:12.03 | *** join/#asterisk matrix1233 (~matrix123@185.13.106.225) |
| 10:26.06 | *** join/#asterisk nickvsnetworking (~nickvsnet@103.31.113.82) |
| 11:05.27 | *** join/#asterisk nickvsnetworking (~nickvsnet@103.31.113.82) |
| 11:43.08 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 11:56.28 | *** join/#asterisk pchero_work (~pchero@2a02:a210:2241:6480:6c35:28cc:a369:1814) |
| 12:36.30 | *** join/#asterisk pvoigt (~Linux@unaffiliated/pvoigt) |
| 13:00.57 | *** join/#asterisk gerhard7 (~gerhard7@ip5657ee30.direct-adsl.nl) |
| 13:05.34 | *** join/#asterisk defsdoor (~Andrew@cpc120600-sutt6-2-0-cust232.19-1.cable.virginm.net) |
| 13:07.44 | *** join/#asterisk pchero_work (~pchero@2a02:a210:2241:6480:6c35:28cc:a369:1814) |
| 13:32.53 | *** join/#asterisk Janos (~textual@201.204.94.76) |
| 13:37.06 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 13:40.16 | *** join/#asterisk FH_thecat (~FH_thecat@75.11.25.212.ftth.as8758.net) |
| 14:07.12 | *** join/#asterisk [TK]D-Fender (~joe@64.235.216.2) |
| 14:13.50 | *** join/#asterisk MarkSX (~MarkSX@unaffiliated/marksx) |
| 14:20.39 | *** join/#asterisk sa02irc (~mbax@155-079-043-212.ip-addr.inexio.net) |
| 14:27.17 | *** join/#asterisk pchero_work (~pchero@2a02:a210:2241:6480:41ed:4e34:477b:633) |
| 16:32.15 | drmessano | No edging here, thx |
| 16:51.07 | igcewieling | Edging is for procrastinaters. |
| 16:53.30 | *** join/#asterisk miralin (~Thunderbi@178.34.161.83) |
| 17:01.27 | Samot | Living on the Edge is FreePBX's motto. |
| 17:04.50 | *** join/#asterisk sa02irc (~mbax@155-079-043-212.ip-addr.inexio.net) |
| 17:08.44 | craigify | Anybody having problems with Sectigo's (formerly Comodo) new intermediary certs and PJSIP TLS? |
| 17:09.18 | sibiria | it expired yesterday. update your certstore |
| 17:09.35 | craigify | yes I know. I'm talking about the NEW bundles |
| 17:11.48 | sibiria | you're sure asterisk picked the new ones up? (i.e. you restarted asterisk just to be sure) |
| 17:12.52 | craigify | yes. they work every else on the various NodeJS and Apache instances, but the same triggers SSL errors on Asterisk |
| 17:14.56 | craigify | previously I'd get errors that looked like it knew the bundle contained an expired cert, and the new bundle generates an unknown CA type of error in the logs. I've downloaded multiple bundles directly from comodo, plus tried making my own chain file from the intermediary certs. I can't get it to work so far. |
| 17:16.26 | craigify | there's got to be something different with the format of the new intermediary certs, or the SHA algorithm used. I'm a bit over my head with how they're generated |
| 17:17.09 | sibiria | if you're using a full chain cert, did you make sure the order of the certs is correct? |
| 17:17.20 | sibiria | of the one you baked yourself, that is |
| 17:17.42 | sibiria | root -> intermediate -> CN etc. |
| 17:18.14 | *** join/#asterisk miralin1 (~Thunderbi@195.209.246.194) |
| 17:18.23 | craigify | At this point I've tried so many things I don't remember. I'm going to try that again.... |
| 17:18.50 | craigify | it's possibly nodejs and apache's SSL subsystem are morre forgiving |
| 17:18.58 | sibiria | formally this is a requirement. a small number of applications enforce it |
| 17:19.15 | sibiria | (no idea about asterisk/pjsip) |
| 17:34.15 | craigify | I've talked to support. I've used a bundle they provided and one I made |
| 17:34.22 | craigify | neither work, unfrtunately |
| 17:34.33 | craigify | I need to look into purchasing digium support |
| 17:37.00 | *** join/#asterisk retentiveboy (~retentive@c-73-43-121-243.hsd1.ga.comcast.net) |
| 17:43.16 | drmessano | craigify: Have you installed the new CA Cert into the store on the server itself? |
| 17:43.32 | craigify | I have |
| 17:43.42 | craigify | [2020-05-31 13:43:05.473] WARNING[30715] pjproject: SSL SSL_ERROR_SSL (Handshake): Level: 0 err: <336151576> <SSL routines-ssl3_read_bytes-tlsv1 alert unknown ca> len: 0 peer: 184.186.17.181:47497 |
| 17:44.14 | craigify | note the unknown ca |
| 17:44.35 | craigify | oh wait.... |
| 17:44.40 | craigify | you say 'on the store' |
| 17:44.46 | craigify | what do you mean by that? |
| 17:44.56 | drmessano | https://stackoverflow.com/questions/17437100/how-to-avoid-the-tlsv1-alert-unknown-ca-error-in-libmproxy |
| 17:46.07 | drmessano | Copy the cert to the proper location on the server and run whatever your distro needs to reload certs |
| 17:46.42 | file | what is 184.186.17.181? |
| 17:46.46 | drmessano | in Debubuntu land it's in that post.. copied to the path and and the dpkg-reconfigure ca-certificates |
| 17:46.55 | craigify | I use ansible, BUT for this server I'm copying it into the directory by hand. I instruct PJSIP via ca_cert_list directive to point to the CA on the filesystem |
| 17:46.58 | drmessano | I googled for that error and every post points to the same process |
| 17:47.04 | *** join/#asterisk gavlee (~gav@unaffiliated/gavlee) |
| 17:47.09 | craigify | file, that's one of my phones on my desk |
| 17:47.14 | craigify | trying to connect |
| 17:47.16 | file | have you updated the phone? |
| 17:47.25 | craigify | thats going to be a huge problem |
| 17:47.33 | craigify | because of the phones in deployment |
| 17:47.59 | craigify | but no, I have not |
| 17:48.22 | file | if the chain of trust including intermediate isn't sufficient for the certificate store on the phone, then it will not be able to verify |
| 17:49.01 | file | you can use openssl s_client -connect <ip>:<port> |
| 17:49.06 | drmessano | Ah that's on the phone |
| 17:49.12 | drmessano | Yeah what he said |
| 17:49.15 | file | to verify against the local OpenSSL store that your certificate chain is correct according to it |
| 17:49.50 | craigify | I hadn't considered that the damn phones hadn't possibly updated their trusted cert list |
| 17:50.22 | Samot | This is going to break a lot of TLS deployments on old phones, eh? |
| 17:51.00 | Samot | The TLS1.0/1.1 shut down, I mean |
| 17:51.50 | drmessano | Hopefully these phones use a provisioning server where you can just feed them a new CA |
| 17:51.59 | craigify | most of them are |
| 17:52.00 | craigify | but not all |
| 17:57.22 | *** join/#asterisk aoeui (~aoeui@unaffiliated/aoeui) |
| 18:01.27 | craigify | well, telling the phone to not verify the cert worked and might be a quick fix for Monday |
| 18:01.35 | craigify | this is a shit show |
| 18:09.09 | craigify | file, thanks for pointing me in the phone's direction |
| 18:09.53 | file | aye |
| 18:09.59 | craigify | I did test it with openssl s_client and I *think* it looks good. Lots of verbose output, through, but no errors or warnings. And it reads the CA chain. |
| 18:11.51 | craigify | if I were to add some certicates to the phones manually, I need to add the certs in the chain? |
| 18:12.20 | drmessano | Depends on the phone |
| 18:12.31 | craigify | or my domain cert |
| 18:12.38 | craigify | I really am not well versed in TLS |
| 18:12.38 | drmessano | Some have a CA option |
| 18:12.56 | drmessano | Some break out the CA and the chain into two options |
| 18:16.01 | drmessano | craigify: Generally no, you don't need your domain, just the CA chain |
| 18:17.30 | craigify | ok good |
| 18:18.02 | craigify | I've got the option for these yealinks to just not verify the CA at the moment |
| 18:18.07 | craigify | need to find the polycom setting |
| 18:18.18 | craigify | stuck them on the provisioning system |
| 18:18.26 | craigify | I can get it done securely later |
| 18:20.34 | *** join/#asterisk stefan3311 (c3b5d3c6@195.181.211.198) |
| 18:21.30 | drmessano | If you don't have phones being provisioned, I highly recommend getting them set up. It's just not convenient or acceptable anymore to have devices "i'll touch when I need to". Security updates, setting changes, cert updates. Things evolve a lot faster now. |
| 18:21.56 | craigify | yeah. there's just a few legacy things that don't. Everything else definietly is |
| 18:22.01 | craigify | for that reason |
| 18:22.50 | drmessano | I've had decade-old devices get more updates in the past year than in the 8-9 before. It's amazing |
| 18:23.36 | stefan3311 | Hello everybody! Please help me with exten, I use asterisk 16.10.0, I want to configure this, but not working: exten => _38099X.,1,Goto(line1,3801${EXTEN},1) exten => _38095X.,3,Goto(line1,3802${EXTEN},1) exten => _38050X.,2,Goto(line1,3803${EXTEN},1) |
| 18:24.16 | stefan3311 | ....whta's wrong with this, please? |
| 18:25.10 | stefan3311 | The first line executed, but the second and third not. |
| 18:25.35 | Samot | They aren't in the right order? |
| 18:25.39 | Samot | Why is 2 after 3? |
| 18:26.18 | *** join/#asterisk matrix1233 (~matrix123@185.13.106.119) |
| 18:26.21 | stefan3311 | I try to match phone numbers based on country code + prefix |
| 18:26.48 | Samot | I mean the priorities. |
| 18:27.20 | stefan3311 | :( I'm not sure how must be.... |
| 18:27.20 | file | why would the second and third execute? |
| 18:27.27 | sibiria | different extensions, they should all have prio 1 |
| 18:27.34 | Samot | there is that too |
| 18:27.38 | sibiria | the other two have no prio 1 so they will neve rhappen |
| 18:28.33 | stefan3311 | @sibiria What is the correct priority please? |
| 18:28.40 | sibiria | stefan3311: 1 |
| 18:28.51 | stefan3311 | For all? |
| 18:28.54 | sibiria | an extension must always start with priority 1 |
| 18:29.08 | drmessano | They're different extensions, pal |
| 18:29.16 | drmessano | So they must all start with a 1 |
| 18:29.58 | stefan3311 | ??? --> exten => _38099X.,1,Goto(line1,3801${EXTEN},1) exten => _38095X.,1,Goto(line1,3802${EXTEN},1) exten => _38050X.,1,Goto(line1,3803${EXTEN},1) |
| 18:30.06 | Samot | _38099X.,1,Goto(line1,3801${EXTEN},1) <-- The first action it to GoTo another context,exten,priority |
| 18:30.14 | sibiria | stefan3311: yes |
| 18:30.16 | Samot | So even if they were 2, 3 why would they execute? |
| 18:31.06 | Samot | stefan3311: Let's take a breath and step back here... |
| 18:31.20 | Samot | exten => _38099X.,1,Goto(line1,3801${EXTEN},1) <-- This has some issues. |
| 18:31.43 | Samot | So if the extension is 38099123456 it's going to match. |
| 18:32.02 | Samot | Then it is going to send it to line1,380138099123456,1 |
| 18:32.06 | Samot | Is THAT what you want? |
| 18:32.53 | stefan3311 | @Samot Here is the logic what I try to use: IF number starts with 38099 then need add a prefix with 3801 ---> IF number starts with 38095 then need add a prefix with 3802 ---> IF number starts with 38050 then need add a prefix with 3803 |
| 18:33.15 | Samot | But 38 is the country code? |
| 18:33.35 | stefan3311 | @Samot 380 |
| 18:33.46 | Samot | So you're want to prepend the country code twice? |
| 18:34.25 | Samot | Because if you are matching on 38099 that means the country code is 380 and the prefix is 99 |
| 18:34.36 | Samot | So now you're making it 380138099 |
| 18:34.38 | stefan3311 | Unfortunately looks like the same BUT NOT. I want to prepend 3801, 3802, 3803 |
| 18:34.42 | Samot | Which is the country code twice |
| 18:34.46 | Samot | OK |
| 18:35.15 | Samot | So what is the actual problem? |
| 18:35.45 | stefan3311 | This line is working perfect: exten => _38099X.,1,Goto(line1,3801${EXTEN},1) |
| 18:35.54 | stefan3311 | ...but the next lines not |
| 18:36.00 | Samot | Because it's wrong. |
| 18:36.08 | Samot | Which you have been told multiple times |
| 18:36.10 | sibiria | but we told you, start by just setting all three extensions' priority to 1 |
| 18:36.14 | sibiria | and then take it from there |
| 18:36.24 | sibiria | because that's the foremost problem with your dial plan |
| 18:36.27 | stefan3311 | Thanks, I go to try |
| 18:38.07 | *** join/#asterisk miralin1 (~Thunderbi@178.34.161.83) |
| 18:38.37 | stefan3311 | Thank you guys!!!! It's working. :) |
| 18:38.45 | *** join/#asterisk jkroon (~jkroon@165.16.203.102) |
| 18:40.54 | Samot | drmessano: iNum is going buh-bye for good. |
| 18:41.00 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 18:41.23 | drmessano | Oh yeah? |
| 18:41.24 | Samot | Decommissioning starts on the 4th and ends on the 6th. |
| 18:41.32 | drmessano | oh wow |
| 18:41.59 | Samot | Voxbone sent out a notice a while back they were transferring iNum to the ITU |
| 18:42.14 | Samot | The ITU came back with "We have no idea what they are talking about. We don't do that type of thing" |
| 18:42.34 | Samot | And last week they sent out notices to their partner providers that they were just decommissioning the whole thing. |
| 18:43.30 | Samot | https://www.irccloud.com/pastebin/daWcigWH/ |
| 18:43.32 | drmessano | Im sure millions of voipers will protest now |
| 18:43.39 | Samot | That was the entire notice. |
| 18:43.58 | sibiria | ITU said they had no idea what it was |
| 18:44.09 | Samot | The ITU isn't a service provider. |
| 18:44.25 | sibiria | yet they 10 years ago or something allocated a country code for it |
| 18:44.38 | sibiria | +888 or whatever it was |
| 18:44.39 | Samot | ITU's involved stopped at assigning the non-geo area code |
| 18:44.57 | Samot | involvement |
| 18:45.55 | Samot | sibiria: It turns out that iNUM like other things from 15 years ago that had a purpose then (like IAX), no longer really have a spot these days. |
| 18:46.14 | Samot | It's almost like things have evolved and those needs were erased. |
| 18:49.20 | Samot | Not only has International rates gone down. We didn't have Whatsapp, FaceTime, Facebook, Skype, la la la la back then either. |
| 18:51.31 | *** join/#asterisk miralin1 (~Thunderbi@178.34.161.83) |
| 18:56.34 | drmessano | I can't imagine how the ITU lost track of the allocation of a subset of a country code that was seldom used |
| 18:56.39 | drmessano | :eyeroll: |
| 18:57.23 | *** join/#asterisk miralin1 (~Thunderbi@178.34.161.83) |
| 18:57.41 | Samot | They didn't lose track. They were just unaware they were becoming the service provider for it. |
| 18:57.49 | Samot | Which is not something they do. |
| 18:58.59 | drmessano | Well, excuse me |
| 19:00.49 | Samot | You are excused. |
| 19:02.45 | *** join/#asterisk matrix1233 (~matrix123@185.13.106.119) |
| 19:14.00 | *** join/#asterisk retentiveboy (~retentive@c-73-43-121-243.hsd1.ga.comcast.net) |
| 19:31.14 | craigify | guess what I just learned |
| 19:31.40 | craigify | so since I'm using the same fucking SSL cert for my HTTPS provisioning, the phones won't provision |
| 19:31.49 | craigify | I'm going to switch certs entirely |
| 19:31.50 | craigify | lol |
| 19:32.29 | file | oh... yeah... that'd certainly be a thing |
| 19:58.36 | sibiria | time to switch to LE |
| 19:58.51 | craigify | that's exactly what I'm doing actually |
| 20:00.51 | *** join/#asterisk rpifan (~rpifan@p200300d2671f6236b0e63458ab0a37a0.dip0.t-ipconnect.de) |
| 20:03.20 | *** join/#asterisk tomaluca95 (~quassel@kde/developer/tomaluca) |
| 20:26.08 | *** join/#asterisk rpifan (~rpifan@p200300d2671f6236b0e63458ab0a37a0.dip0.t-ipconnect.de) |
| 20:30.59 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 20:34.26 | *** join/#asterisk rpifan (~rpifan@p200300d2671f6236b0e63458ab0a37a0.dip0.t-ipconnect.de) |
| 20:47.15 | *** join/#asterisk Ryushin (~Ryushin@2001:470:4b:38f:777::8762) |
| 20:52.32 | *** join/#asterisk CatCow97 (~mine9@c-73-96-109-206.hsd1.or.comcast.net) |
| 21:00.03 | craigify | let's encrypt to the rescue |
| 21:00.30 | craigify | looks well supported on polycom and yealink |
| 21:02.06 | *** join/#asterisk rpifan_ (~rpifan@p200300d2671f623274baef4fe0859097.dip0.t-ipconnect.de) |
| 21:21.09 | *** join/#asterisk miralin1 (~Thunderbi@178.34.161.83) |
| 21:29.41 | *** join/#asterisk Typhon (~Typhon@dslb-088-067-128-174.088.067.pools.vodafone-ip.de) |
| 21:34.30 | *** join/#asterisk miralin1 (~Thunderbi@178.34.161.83) |
| 21:59.28 | *** join/#asterisk Jesterboxboy (~Thunderbi@84-115-150-8.cable.dynamic.surfer.at) |
| 22:13.36 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 22:29.10 | *** join/#asterisk driz (~driz@joinsg.net) |
| 23:06.19 | *** join/#asterisk yuljk (~yuljk@unaffiliated/yuljk) |
| 23:34.31 | *** join/#asterisk CatCow97 (~mine9@c-73-96-109-206.hsd1.or.comcast.net) |
| 23:35.56 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |
| 23:43.26 | *** join/#asterisk miralin (~Thunderbi@178.34.161.83) |
| 23:57.55 | *** join/#asterisk verzo (~verzo@gateway/tor-sasl/verzo) |