Re: [sipcore] SIP client certs

Hi Olle,
Are you referring to
https://tools.ietf.org/html/draft-dotson-sip-certificate-auth-04 ?

-Ash

On Tue, Nov 24, 2020 at 4:31 AM Olle E. Johansson <oej@edvina.net> wrote:

> Hi!
> I hope everyone stays safe in these times.
>
> During last week’s IETF I ended up in a discussion in RUM about using TLS
> client certs in SIP. I have been testing this a long time ago, but
> obviously not fully. The question I got I failed to find an answer to,
> which is annoying :-)
>
> Here it goes, let’s see if you can help:
>
> SIP UA -> Ingress proxy -> Registrar
>
> If the Ingress Proxy requires a client cert for authentication, that
> certificate is only seen on the first hop between the UA and the proxy. How
> can we make the registrar validate and trust the client cert for the
> registration?
>
> If there is absolute trust between the ingress proxy and the registrar, I
> guess we could parse out a lot of cert info and add to SIP headers and send
> forward. If there is no trust relationship (let’s say the Ingress Proxy is
> an enterprise SBC and the registrar is a service provider) then we have a
> problem.
>
> In HTTP there’s a CONNECT method so the SIP UA can establish a direct TLS
> session to the registrar through a proxy. There is a very old expired draft
> for a SIP connect method that could potentially be helpful here.
>
> I do remember that we had a SIP Connect draft many years ago.
>
> Any ideas?
>
> Cheers,
> /Olle
> _______________________________________________
> sipcore mailing list
> sipcore@ietf.org
> https://www.ietf.org/mailman/listinfo/sipcore
>

-- 

*Ash Wilson* | Technical Director
*e:* ash.wilson@valimail.com

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.