0

I am using Ubuntu v14.04.3 LTS and Asterisk 13.3.2. When i try to call to my extension from a sipml5 client to just play a demo-congrats audio, my call gets disconnected instantly. When i check asterisk log, i get following error

[2016-08-24 06:07:49] ERROR[31730][C-0000000c]: res_rtp_asterisk.c:2042 __rtp_recvfrom: DTLS failure occurred on RTP instance '0x7f547c013c68' due to reason 'sslv3 alert handshake failure', terminating
[2016-08-24 06:07:49] WARNING[31730][C-0000000c]: res_rtp_asterisk.c:3911 ast_rtcp_read: RTCP Read error: Unspecified.  Hanging up.
[2016-08-24 06:07:49] WARNING[31730][C-0000000c]: app_playback.c:493 playback_exec: Playback failed on SIP/104600-00000007 for /var/www/html/fetch_prompt
[2016-08-24 06:07:49] ERROR[31730][C-0000000c]: utils.c:1402 ast_carefulwrite: write() returned error: Broken pipe

I am using Chrome v54.

I think this error is with openssl, but doesn't get a correct and complete answer yet to solve this issue. Does any one know how to solve this issue?

2
  • I suspect deprecation of the SSLv3 protocol. I would try running a packet sniffer to confirm that, but without going that far, is there somewhere you can change to TLS?
    – Law29
    Aug 24, 2016 at 6:46
  • Presently i cant change to TLS. Aug 24, 2016 at 6:54

1 Answer 1

1

Solved this issue by upgrading openssl. Use below commands to upgrade openssl in Ubuntu 14

# echo 'deb http://us.archive.ubuntu.com/ubuntu/ xenial main restricted universe multiverse' > /etc/apt/sources.list.d/xenial.list
# aptitude update
# aptitude install -y openssl libssl-dev
# rm /etc/apt/sources.list.d/xenial.list
# aptitude update

Use below commands to check openssl version

# ldd /usr/sbin/asterisk  | grep libssl
libssl.so.1.0.0 => /lib/x86_64-linux-gnu/libssl.so.1.0.0 (0x00007f33ce117000)

# strings /lib/x86_64-linux-gnu/libssl.so.1.0.0 | grep 1.0.2
OPENSSL_1.0.2
OPENSSL_1.0.2g
SSLv3 part of OpenSSL 1.0.2g-fips  1 Mar 2016
TLSv1 part of OpenSSL 1.0.2g-fips  1 Mar 2016
DTLSv1 part of OpenSSL 1.0.2g-fips  1 Mar 2016
OpenSSL 1.0.2g-fips  1 Mar 2016

# openssl version
OpenSSL 1.0.2g-fips  1 Mar 2016

After this delete all existing asterisk keys and recreate keys again

# rm /etc/asterisk/keys/*
# cd /usr/src/astersik*/contrb/scripts
# sudo ./ast_tls_cert -C pbx.mycompany.com -O "My Super Company" -d /etc/asterisk/keys
# asterisk -rx "reload"

Source

1
  • You saved me a whole day! Suggestions: 1. Restart the asterisk with $ sudo fwconsole restart, reload do not work for me. 2. And you do not have to delete all the keys in the asterisk, just create a new one for yourself after restart the asterisk.
    – Damon Yuan
    Apr 18, 2017 at 4:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .