Modifying SIP trunk TLS cipher suite offered in Client Hello

FreePBX Configuration
1

Hi,

I have a TLS trunk registered from FreePBX 17.0.19.11 to a service provider and the client hello from FreePBX is offering the following cipher suites

Cipher Suites (4 suites)

            Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)

            Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)

            Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)

            Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)

I’d like to offer just these two (for testing)

Cipher Suites (2 suites)

Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)

Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)

But I can’t see where I can change the ciphers offered in FreePBX.

Some guides point me to asterisk pjsip files like pjsip.conf or pjsip.transports.conf but they all have a warning saying “don’t edit, this file was generated by FreePBX”

Is this something I can modify somewhere, if so where please.

Many thanks.

2

One or both will have a #include for a file you can edit. I’m not sure of the specifics for this case, but basically you can add a section to one of these files which is included after the original transport definition, give it the same name as the transport, and in parentheses, put “+,type=transport” (needs checking). Anything you include there is added to end of the original section.

It’s possible that ciphers are allowed to be on multiple lines, in which case you will only be able to add to them, and you would need to define a complete new section (without the +, etc.).

Sorry to be a bit vague, but I’m doing this from first principles, without an example to try.

3

Thank you.

That is the area I have been playing around with but not been successful.

So pjsip.conf has a

#include psjip.transports_custom

For example.

Is the ‘#’ meaning it is a comment and if I want to define things in pjsip.transports_custom do I need to remove the # in pjsip.conf so that in looks at that custom file ?

4

It’s a directive introducer, and if you want it to use the custom file, you need to create that file.