In phonerlite TLS please add entry to specify a trusted root certificate in addition to using Windows CA (some users are not able to change Windows CA). This will allow multiple server certificates signed by the same root certificate instead of specifying everything separately. Some PBXes and phones have it. And it will be very useful to make TLS complete.

botyhc wrote on 02. Feb 2011 at 00:35:

That is a fixed built in certificate. If you wish to use your own certificate you have to configure one.

Phoner Admin wrote on 02. Feb 2011 at 08:37:


I think this enables trust only to phonerlite and not all apps. Also it is self contained. Having this option is very useful. Mostly certificates are self signed, and you cant put them into windows CA. In many cases in companies you can't change the windows CA for example. Instead having this with the app is very useful. If someone doesn't want it they need not add any trusted root CAs.

botyhc wrote on 02. Feb 2011 at 00:59:

Heiko, I also would appreciate this functionality, but in a little different way. Couldn't you add a folder named certs in the PhonerLite folder and put your CAcert (and we other) trusted root certificates there? Then PhonerLite could automatically look into this folder by default to load the trusted certs if TLS is enabled. You don't need to add a new Button into the program. The "Load Windows CA" checkbox is enough beside this folder-solution.

Four reasons to do something like this:
1. Own client/server certificates and private keys could be placed there too, to have them all in one place (I know this can already be done).
2. Its a transparent and common method to put all certs together in one place.
3. See the tree advantages botyhc mentioned in posts #45 and #49.
4. Not everyone wants to trust CAcert certificates. Removing the CAcert root cert from that certs folder will make this authority untrusted. This is not possible at the moment.

Phoner Admin wrote on 02. Feb 2011 at 09:27:

You are right, own server, client and root certificates are really needed only for PTP connections. But for PTP connections they are essential if you want to create really save calls.

Phoner Admin wrote on 02. Feb 2011 at 09:27:

A men in the middle . Think on secret services, economic espionage, ... For them it shouldn't be sooo difficult to place in the middle of the line.

I know Phoner is your hobby, as my is the Secure-SIP-Server project. So just think about my idea with the certs folder, maybe you can see its advantage. 

If I would specify a folder there should be some naming convention to identify what is a root CA and what is any other certificate.
If you enable the option "Load windows CA", then additionally the file "rootcacert.pem" will be loaded if available. That is the actual implementation. So maybe this is enough for you

botyhc wrote on 02. Feb 2011 at 23:31:

PhonerLite compares the domain of the server it contacts and the domain (CN) within the certificate. So if PhonerLite contacts "sip.server.com" but the certificate is for "www.server.com" - there is no match and the icon is not "golden" but grayed. Se the picture at http://www.phonerlite.de/general_en.jpg - there the key icon is "golden".

deti wrote on 03. Feb 2011 at 20:42:

Do you have a problem with this CAcert? That is inside, to support direct TLS connections between 2 PhonerLite instances. I will keep this, as long there is that built in certificate.

Phoner Admin wrote on 04. Feb 2011 at 08:23:

No, not personally at the moment. My concern is only that CAcert certificates are not rally safe. Anyone can get a CAcert certificate for free without identification - at least the short time valid certificates. If someone doesn't want to trust this certs he has no possibility to configure this at the moment.

Phoner Admin wrote on 04. Feb 2011 at 08:23:

My suggestion was, to put only the public CAcert CA certificate in a file (e.g. CA_certs.pem) outside the compiled program and to keep the build in secret private-key and your public certificate inside. Doing this will not affect the actual functionality of PhonerLite and opens configuration capabilities for experienced TLS users. For example one could replace or add other trusted CA certificates in this file. I guess your openssl should be capable to read all trusted CA certificates from within one file.

Phoner Admin wrote on 06. Feb 2011 at 07:41:

Hmmm, according to my understanding the transmitted key for the voice encryption is high security data.

Phoner Admin wrote on 06. Feb 2011 at 07:41:

Right, ZRTP avoids this kind of concerns. But you have to authenticate by reading the SAS to each other. Here I see the advantage of TLS. With a correctly implemented TLS you don't have to read and confirm. You just look at the golden TLS icon and everything should be absolutely OK.


Phoner Admin wrote on 06. Feb 2011 at 07:41:

Right! The thing with the CAcert certificate only can be a problem if you don't trust the server. For normal calls (over a server you trust) this will not be a problem, only if you deal with Peer-To-Peer connections where you don't know if you can trust the phone you are talking to. I must admit, this probably are the absolute minority of calls done by Phoner(Lite). In this rare cases a MITM attack is possible if you can not disable CAcert certificates.

Phoner Admin wrote on 06. Feb 2011 at 07:41:

All right. It was just a suggestion to mind if you work on your TLS code one day again.