Subject: [sipcore] SIP client certs

From: "Olle E. Johansson" <[email-masked]>
Date: Tue, 24 Nov 2020 13:31:08 +0100

Hi!
I hope everyone stays safe in these times.

During last week’s IETF I ended up in a discussion in RUM about using TLS client certs in SIP. I have been testing this a long time ago, but obviously not fully. The question I got I failed to find an answer to, which is annoying :-)

Here it goes, let’s see if you can help:

SIP UA -> Ingress proxy -> Registrar

If the Ingress Proxy requires a client cert for authentication, that certificate is only seen on the first hop between the UA and the proxy. How can we make the registrar validate and trust the client cert for the registration?

If there is absolute trust between the ingress proxy and the registrar, I guess we could parse out a lot of cert info and add to SIP headers and send forward. If there is no trust relationship (let’s say the Ingress Proxy is an enterprise SBC and the registrar is a service provider) then we have a problem.

In HTTP there’s a CONNECT method so the SIP UA can establish a direct TLS session to the registrar through a proxy. There is a very old expired draft for a SIP connect method that could potentially be helpful here.

I do remember that we had a SIP Connect draft many years ago.

Any ideas?

Cheers,
/Olle

---

From: Ash Wilson <[email-masked]>
Date: Tue, 24 Nov 2020 09:41:08 -0800

Hi Olle,
Are you referring to
https://tools.ietf.org/html/draft-dotson-sip-certificate-auth-04 ?

-Ash

On Tue, Nov 24, 2020 at 4:31 AM Olle E. Johansson <[email-masked]> wrote:

> During last week’s IETF I ended up in a discussion in RUM about using TLS
> client certs in SIP. I have been testing this a long time ago, but
> obviously not fully. The question I got I failed to find an answer to,
> which is annoying :-)
>
> If the Ingress Proxy requires a client cert for authentication, that
> certificate is only seen on the first hop between the UA and the proxy. How
> can we make the registrar validate and trust the client cert for the
> registration?
>
> If there is absolute trust between the ingress proxy and the registrar, I
> guess we could parse out a lot of cert info and add to SIP headers and send
> forward. If there is no trust relationship (let’s say the Ingress Proxy is
> an enterprise SBC and the registrar is a service provider) then we have a
> problem.
>
> In HTTP there’s a CONNECT method so the SIP UA can establish a direct TLS
> session to the registrar through a proxy. There is a very old expired draft
> for a SIP connect method that could potentially be helpful here.
>
> _______________________________________________
> sipcore mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipcore
>

-- 

*Ash Wilson* | Technical Director
*e:* [email-masked]

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.