Obihai and GV

RVgo4it · 2025-01-27T20:06:10+00:00

I was a user of GV and Obihai for home phone and e911. I was sad that I was losing both my messaging app and e911 service for home. I looked for a replacement with these requirements: • Open Source • SMS and MMS • Low cost • Home phone line • e911 • Mobile app The closest I found was https://voip.ms for VoIP plus https://linphone.org for SMS/MMS and voice. The only missing piece was getting MMS from voip.ms over to Linphone. I had to write a Python script to bridge the gap. I documented it should anyone else be interested. https://github.com/RVgo4it/mmsgate Thanks for all the help and support over the years from DSL Reports and others. Especially the Obihai firmware mods.

phane

Somewhat-Reticent
Not sure what you mean by that. Are you saying Google has blocked all Obihai devices because of bot swarms and cyberwarfare and that they are dead even with custom firmwares now?

Or are you saying that the services is temporarily unavailable due to something going on at the moment?

Somewhat-Reticent

phane I mean everything on the www struggles these daze.
So, like I posted, don’t take it personal. Not where to start.

OzarkEdge

phane My factory firmware stopped working sometime in the last week.

What does ‘stopped working’ mean? Who was the telephony service provider?

phane

It was through Google voice. No incoming calls were ringing and outgoing calls got a message saying that “there was no response from the service provider”. This happened a few times before but a reboot would fix it. This time it didn’t, so I updated to the arrynrob13 firmware and still no dice. So I attempted a factory reset and reprovision.

OzarkEdge

phane It was through Google voice.

I thought stock firmware stopped working with Google Voice a long time ago. Hence the need for the hacked firmware… a long time ago. Maybe the issue is you just need to get the hacked firmware configured properly… I can’t help with that but someone else around here may be able to.

phane

Steps I have tried:
1) Factory reset and then follow instructions.
2) The above but change timezone to correct timezone for my area before following instructions
3) After above, replace ${DSN}1 with accountname from accountname@google.com associated with google voice account after following instructions and reboot (no dice) then attempting instructions again (still no dice and provision script restores ${DSN}1 to username)
4) put host entries in my firewall/DNS for obihai.sip.google.com and obihai.telephony.goog to point to the IP addresses they are supposed to and repeating all of the above
5) blocked www.obitalk.com so that the GV auth token wouldn’t get modified by HP’s new website redirect (had read posts saying that the redirect didn’t change anything, but wanted to rule it out)
6) Using icognito / private browsing mode to prevent old cookies / cached data from messing things up in the WUI

No matter what I do, same “Connecting to 216.239.36.145;Token Error”

So either my personal GV account had some restriction attached to it (unlikely, it’s been standard residential use, mostly for our kids), there’s a temporary issue that’s been going on for days, google has made a change on their end that makes arrynrob13 no longer work, there’s an issue with my local firewall that has just started this problem despite no recent changes, or I’m somehow doing something wrong with a complete factory reset and following the instructions to the letter.

For reference, the “instructions” are listed in the WUI of arrynrob’s firmware under Google Voice, Provisioning and are as follows:

Instructions:
1) open this link in new tab to request a single-use authorization token for “obitalk.com”: request GV oauth token

2) after logging into your google voice account and agreeing to grant obitalk.com permission to make/receive calls (click ‘select all’ permissions if prompted), your browser will receive a 404 error from www.obitalk.com because it is no longer functional as of 10/31/2024. however, an authorization code is present in that url

3) copy/paste the full non-functional url from the other tab into the textbox below (it will look like ‘https://www.obitalk.com/obinet/pg/obhdev/gvtoken?code=xxxxxxxxxxxxxxxxxx&scope=blah&lotsofotherstuff=junk’) and then click ‘Get Refresh Token From Code In URL’ button below

4) copy/paste the Refresh Token contents (that will appear after button is pressed) into obi local web gui’s AuthPassword field at Voice Services > SPx Service > SIP Credentials > AuthPassword (SPx # must match config chosen in next step), then click Submit at the bottom

5) based on the desired SPx # used in step5, choose the corresponding config URL for provisioning:
SP1: https://www.obifirmware.com/fw/EnableGVSIPWithoutOBiTALK.xml
SP2: https://www.obifirmware.com/fw/EnableGVSIPWithoutOBiTALK_SP2.xml
SP3: https://www.obifirmware.com/fw/EnableGVSIPWithoutOBiTALK_SP3.xml
SP4: https://www.obifirmware.com/fw/EnableGVSIPWithoutOBiTALK_SP4.xml

6) copy/paste chosen url into local webgui at System Management > Auto Provisioning > ITSP Provisioning > ConfigURL, set provisioning “Method” to “System Start”, click Submit at the bottom, then click Reboot to force the config to download

I’m doing all of this on SP1, since it’s the only service I really need / want until I re-up my 911 access, which has expired and I won’t bother to renew if I can’t get this working.

We have our GV number ringing on all of our cellphones for now and it is working for both incoming and outgoing calls, so there seems to be no issue with the number itself or the account beyond this.

namaste

I noticed an email from Google telling me the following

Hello Google Developer,

In accordance with OAuth 2.0 Policies, the following projects that you manage have OAuth clients that have been inactive for at least 5 months, and will be deleted in 30 days unless you take action:

namaste

Visit the Google Cloud Console to see the complete list of inactive clients.

To prevent OAuth clients from being deleted, use them in a Sign-in with Google flow or to exchange a refresh token for an access token. Do this for each client that you want to retain.

If you no longer need these OAuth clients, no additional action is required, and they will be automatically deleted for you. Once OAuth clients are deleted, you will have up to 30 days to restore them by visiting the Google Cloud Console.

Thank you for using the Google Auth Platform!

My Obihai 202 has been running without issue since 2018. I checked the account in question and noticed that multifactor authentication is required just to access your account now on https://console.cloud.google.com. I finally get in after wrestling with google as usual and notice the last oauth2 access was also in 2018.

So has the token been valid all these years and never refreshed? This appears to be a “security” thing on google’s end to expire unused credentials. Was the initial authorization only required as a one time deal and the original oauth can be safely left to expire? Will this google voice line just die if left alone and require re-authorization?

Can anyone chime in here? Thanks.

andre2

FYI, I was able to reprovision my old OBi200 (which was already working) just now with the modded firmware instructions in the webui at Google Voice/Provisioning, so as I write this it still works.

naf

namaste

my guess is that these notices relate to user-created oauth client-ids that one might have made following the instructions circulating a few years back when GV accepted any custom oauth client that one could create to authenticate against the obihai GV endpoint.

years ago the GV endpoint for obihai changed to only allow (as far as we know) grants given to the specific oauth client that belongs to obi (curiously named “Google Voice TM” instead of obi-something) to be used. this is the client that the defunct obi webserver setup for users and this is what the current instructions built into the mod firmware use, so almost surely if your obi is working with GV these are the ones you are using today.

any obi-related clients in your own cloud console are long since OBE and can be expired/deleted. the only thing necessary today is the grant to the obi “Google Voice TM” app that may be seen under google’s linked apps here: https://myaccount.google.com/linkedapps

phane

Update: I just hooked my Obihai to try to troubleshoot it again and see if something changed and for some reason it immediately connected and was working again without me having to do anything further to it at all. I guess it might have been a temporary issue on the google side.

berkeleyuser

Hello, new member here. My Obi202 that had worked continuously since 2012 finally quit a month ago. Just flashed the firmware today to arrynrob13, which went without a hitch (thank you primerisk for the guide).

Then I tried to set up the flashed Obi with my still active GV account, but didn’t get the required token. Instead I got a screen message that HP had deleted all its historical files so it looks like no new tokens will be issued. The only links went to their announcement pages of the end of service, no embedded token in the link.

Has anyone here successfully gotten a token in the past month, or is this ride truly over?

phane

berkeleyuser I feel like you might be getting confused. Here are the instructions embedded in arrynrob13:

`2) after logging into your google voice account and agreeing to grant obitalk.com permission to make/receive calls (click ‘select all’ permissions if prompted), your browser will receive a 404 error from www.obitalk.com because it is no longer functional as of 10/31/2024. however, an authorization code is present in that url

3) copy/paste the full non-functional url from the other tab into the textbox below (it will look like ‘https://www.obitalk.com/obinet/pg/obhdev/gvtoken?code=xxxxxxxxxxxxxxxxxx&scope=blah&lotsofotherstuff=junk’) and then click ‘Get Refresh Token From Code In URL’ button below`

So, yes, the page will not exist. The token isn’t on HP or Obitalk’s website. The token is issued by Google and is embedded in the URL that takes you to the non-existent site.

After going to the site that no longer exists, you copy and paste the URL from the top of your browser window into the box at the bottom of the instruction page and click on the “Get Refresh Token from Code in URL” button to get the token Google tried to send to Obitalk to provision your device.

berkeleyuser

Thank you! That did it! I missed that critical detail of looking at the URL for the whole page. Appreciate your quick reply so I won’t have to lose any sleep tonight.

In summary, as of today September 7, 2026 an obi202 was successfully updated and returned to service following the instructions in the primerisk guide.

berkeleyuser

Also huge thanks to the firmware developers. I had to apply all three files: the 5921ex downgrade, 6259 signed fw bypass, and the 8680ex arrynrob13, and they all worked perfectly

WhyADuck

Obihai certificates about to expire? Please see the end of the FreePBX for the Raspberry Pi thread for more info but it appears that the certificates used in our Obihai devices, custom firmware, etc. (obihai.crt, obihai.key, and obihai.pem) will stop working on November 7. And as far as I am aware there is no way to obtain replacements, though I would be very happy if I’m wrong about that.

jsolo1

Way back when, @naf posted an updated certificate bundle (shown below). This goes into the /scratch folder of the obi200/202 as customca.pem . The oldest expiry in this bundle is a root cert that expires 20280128 (little more than a year from now). I’m not sure what this means, but my guess is obi20x gv service (even if provisioned offline) will cease to function after that date.

@naf Is this correct? Any updated bundles to extend the expiry?

cat customca.pem -----BEGIN CERTIFICATE----- MIIB3DCCAYOgAwIBAgINAgPlfvU/k/2lCSGypjAKBggqhkjOPQQDAjBQMSQwIgYD VQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0gUjQxEzARBgNVBAoTCkdsb2Jh bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTIxMTEzMDAwMDAwWhcNMzgw MTE5MDMxNDA3WjBQMSQwIgYDVQQLExtHbG9iYWxTaWduIEVDQyBSb290IENBIC0g UjQxEzARBgNVBAoTCkdsb2JhbFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wWTAT BgcqhkjOPQIBBggqhkjOPQMBBwNCAAS4xnnTj2wlDp8uORkcA6SumuU5BwkWymOx uYb4ilfBV85C+nOh92VC/x7BALJucw7/xyHlGKSq2XE/qNS5zowdo0IwQDAOBgNV HQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVLB7rUW44kB/ +wpu+74zyTyjhNUwCgYIKoZIzj0EAwIDRwAwRAIgIk90crlgr/HmnKAWBVBfw147 bmF0774BxL4YSFlhgjICICadVGNA3jdgUM/I2O2dgq43mLyjj0xMqTQrbO/7lZsm -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFVzCCAz+gAwIBAgINAgPlk28xsBNJiGuiFzANBgkqhkiG9w0BAQwFADBHMQsw CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU MBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwggIiMA0GCSqGSIb3DQEBAQUA A4ICDwAwggIKAoICAQC2EQKLHuOhd5s73L+UPreVp0A8of2C+X0yBoJx9vaMf/vo 27xqLpeXo4xL+Sv2sfnOhB2x+cWX3u+58qPpvBKJXqeqUqv4IyfLpLGcY9vXmX7w Cl7raKb0xlpHDU0QM+NOsROjyBhsS+z8CZDfnWQpJSMHobTSPS5g4M/SCYe7zUjw TcLCeoiKu7rPWRnWr4+wB7CeMfGCwcDfLqZtbBkOtdh+JhpFAz2weaSUKK0Pfybl qAj+lug8aJRT7oM6iCsVlgmy4HqMLnXWnOunVmSPlk9orj2XwoSPwLxAwAtcvfaH szVsrBhQf4TgTM2S0yDpM7xSma8ytSmzJSq0SPly4cpk9+aCEI3oncKKiPo4Zor8 Y/kB+Xj9e1x3+naH+uzfsQ55lVe0vSbv1gHR6xYKu44LtcXFilWr06zqkUspzBmk MiVOKvFlRNACzqrOSbTqn3yDsEB750Orp2yjj32JgfpMpf/VjsPOS+C12LOORc92 wO1AK/1TD7Cn1TsNsYqiA94xrcx36m97PtbfkSIS5r762DL8EGMUUXLeXdYWk70p aDPvOmbsB4om3xPXV2V4J95eSRQAogB/mqghtqmxlbCluQ0WEdrHbEg8QOB+DVrN VjzRlwW5y0vtOUucxD/SVRNuJLDWcfr0wbrM7Rv1/oFB2ACYPTrIrnqYNxgFlQID AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E FgQU5K8rJnEaK0gnhS9SZizv8IkTcT4wDQYJKoZIhvcNAQEMBQADggIBAJ+qQibb C5u+/x6Wki4+omVKapi6Ist9wTrYggoGxval3sBOh2Z5ofmmWJyq+bXmYOfg6LEe QkEzCzc9zolwFcq1JKjPa7XSQCGYzyI0zzvFIoTgxQ6KfF2I5DUkzps+GlQebtuy h6f88/qBVRRiClmpIgUxPoLW7ttXNLwzldMXG+gnoot7TiYaelpkttGsN/H9oPM4 7HLwEXWdyzRSjeZ2axfG34arJ45JK3VmgRAhpuo+9K4l/3wV3s6MJT/KYnAK9y8J ZgfIPxz88NtFMN9iiMG1D53Dn0reWVlHxYciNuaCp+0KueIHoI17eko8cdLiA6Ef MgfdG+RCzgwARWGAtQsgWSl4vflVy2PFPEz0tv/bal8xa5meLMFrUKTX5hgUvYU/ Z6tGn6D/Qqc6f1zLXbBwHSs09dR2CQzreExZBfMzQsNhFRAbd03OIozUhfJFfbdT 6u9AWpQKXCBfTkBdYiJ23//OYb2MI3jSNwLgjt7RETeJ9r/tSQdirpLsQBqvFAnZ 0E6yove+7u7Y/9waLd64NnHi/Hm3lCXRSHNboTXns5lndcEZOitHTtNCjv0xyBZm 2tIMPNuzjsmhDYAPexZ3FL//2wmUspO8IFgV6dtxQ/PeEMMA3KgqlbbC1j+Qa3bb bP6MvPJwNQzcmRk13NfIRmPVNnGuV/u3gm3c -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFVzCCAz+gAwIBAgINAgPlrsWNBCUaqxElqjANBgkqhkiG9w0BAQwFADBHMQsw CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU MBIGA1UEAxMLR1RTIFJvb3QgUjIwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjIwggIiMA0GCSqGSIb3DQEBAQUA A4ICDwAwggIKAoICAQDO3v2m++zsFDQ8BwZabFn3GTXd98GdVarTzTukk3LvCvpt nfbwhYBboUhSnznFt+4orO/LdmgUud+tAWyZH8QiHZ/+cnfgLFuv5AS/T3KgGjSY 6Dlo7JUle3ah5mm5hRm9iYz+re026nO8/4Piy33B0s5Ks40FnotJk9/BW9BuXvAu MC6C/Pq8tBcKSOWIm8Wba96wyrQD8Nr0kLhlZPdcTK3ofmZemde4wj7I0BOdre7k RXuJVfeKH2JShBKzwkCX44ofR5GmdFrS+LFjKBC4swm4VndAoiaYecb+3yXuPuWg f9RhD1FLPD+M2uFwdNjCaKH5wQzpoeJ/u1U8dgbuak7MkogwTZq9TwtImoS1mKPV +3PBV2HdKFZ1E66HjucMUQkQdYhMvI35ezzUIkgfKtzra7tEscszcTJGr61K8Yzo dDqs5xoic4DSMPclQsciOzsSrZYuxsN2B6ogtzVJV+mSSeh2FnIxZyuWfoqjx5RW Ir9qS34BIbIjMt/kmkRtWVtd9QCgHJvGeJeNkP+byKq0rxFROV7Z+2et1VsRnTKa G73VululycslaVNVJ1zgyjbLiGH7HrfQy+4W+9OmTN6SpdTi3/UGVN4unUu0kzCq gc7dGtxRcw1PcOnlthYhGXmy5okLdWTK1au8CcEYof/UVKGFPP0UJAOyh9OktwID AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E FgQUu//KjiOfT5nK2+JopqUVJxce2Q4wDQYJKoZIhvcNAQEMBQADggIBAB/Kzt3H vqGf2SdMC9wXmBFqiN495nFWcrKeGk6c1SuYJF2ba3uwM4IJvd8lRuqYnrYb/oM8 0mJhwQTtzuDFycgTE1XnqGOtjHsB/ncw4c5omwX4Eu55MaBBRTUoCnGkJE+M3DyC B19m3H0Q/gxhswWV7uGugQ+o+MePTagjAiZrHYNSVc61LwDKgEDg4XSsYPWHgJ2u NmSRXbBoGOqKYcl3qJfEycel/FVL8/B/uWU9J2jQzGv6U53hkRrJXRqWbTKH7QMg yALOWr7Z6v2yTcQvG99fevX4i8buMTolUVVnjWQye+mew4K6Ki3pHrTgSAai/Gev HyICc/sgCq+dVEuhzf9gR7A/Xe8bVr2XIZYtCtFenTgCR2y59PYjJbigapordwj6 xLEokCZYCDzifqrXPW+6MYgKBesntaFJ7qBFVHvmJ2WZICGoo7z7GJa7Um8M7YNR TOlZ4iBgxcJlkoKM8xAfDoqXvneCbT+PHV28SSe9zE8P4c52hgQjxcCMElv924Sg JPFI/2R80L5cFtHvma3AH/vLrrw4IgYmZNralw4/KBVEqE8AyvCazM90arQ+POuV 7LXTWtiBmelDGDfrs7vRWGJB82bSj6p4lVQgw1oudCvV0b4YacCs1aTPObpRhANl 6WLAYv7YTVWW4tAR+kg0Eeye7QUd5MjWHYbL -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIICCTCCAY6gAwIBAgINAgPluILrIPglJ209ZjAKBggqhkjOPQQDAzBHMQswCQYD VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG A1UEAxMLR1RTIFJvb3QgUjMwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjMwdjAQBgcqhkjOPQIBBgUrgQQAIgNi AAQfTzOHMymKoYTey8chWEGJ6ladK0uFxh1MJ7x/JlFyb+Kf1qPKzEUURout736G jOyxfi//qXGdGIRFBEFVbivqJn+7kAHjSxm65FSWRQmx1WyRRK2EE46ajA2ADDL2 4CejQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW BBTB8Sa6oC2uhYHP0/EqEr24Cmf9vDAKBggqhkjOPQQDAwNpADBmAjEA9uEglRR7 VKOQFhG/hMjqb2sXnh5GmCCbn9MN2azTL818+FsuVbu/3ZL3pAzcMeGiAjEA/Jdm ZuVDFhOD3cffL74UOO0BzrEXGhF16b0DjyZ+hOXJYKaV11RZt+cRLInUue4X -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIICCTCCAY6gAwIBAgINAgPlwGjvYxqccpBQUjAKBggqhkjOPQQDAzBHMQswCQYD VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG A1UEAxMLR1RTIFJvb3QgUjQwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjOPQIBBgUrgQQAIgNi AATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzuhXyi QHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/lxKvR HYqjQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW BBSATNbrdP9JNqPV2Py1PsVq8JQdjDAKBggqhkjOPQQDAwNpADBmAjEA6ED/g94D 9J+uHXqnLrmvT/aDHQ4thQEd0dlq7A/Cr8deVl5c1RxYIigL9zC2L7F8AjEA8GE8 p/SgguMh1YQdc4acLa/KNJvxn7kjNuK8YAOdgLOaVsjh4rsUecrNIdSUtUlD -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp 1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8 9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE 38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A== -----END CERTIFICATE----- # #md5sum customca.pem 0413c8a0f473e36c5d354b65d15184a3 customca.pem

#,Issuer / Subject,Public Key Algorithm,Validity Period
1,GlobalSign ECC Root CA - R41,ECDSA (Prime256v1),“Nov 13, 2012 – Jan 19, 2038”
2,Google Trust Services LLC (GTS Root R1),RSA (2048-bit),“Jun 22, 2016 – Jun 22, 2036”
3,Google Trust Services LLC (GTS Root R2),RSA (2048-bit),“Jun 22, 2016 – Jun 22, 2036”
4,Google Trust Services LLC (GTS Root R3),ECDSA (P-256),“Jun 22, 2016 – Jun 22, 2036”
5,Google Trust Services LLC (GTS Root R4),ECDSA (P-384),“Jun 22, 2016 – Jun 22, 2036”
6,GlobalSign Root CA,RSA (2048-bit),“Sep 1, 1998 – Jan 28, 2028”

How does this affect gvsip? Still running the same asterisk/freepbx instance from 2018.

naf

jsolo1

no, the bundle you show is certificates used by the obi when validating connections to outside servers (i.e. to the gvsip tls server @ obihai.telephony.goog)

the key/certificate pair that GVSIP people are talking about now that expires soon is one that a client must present to the gvsip tls server so that the server can verify it is a real obi hardware device connecting to it, not just some rogue hacked up asterisk client (haha). the rogue hacked up clients had been using a certificate that i extracted from my obi1xx which happened to have an expiration date next month because the device it was extracted from is 15 years old.

real obi devices each have their own unique certificate installed in the device’s flash at the factory, which may also expire soonish depending on when they were manufactured. my older obi202 [RIP]'s certs would have expired in Feb 2027.

keep in mind we don’t even know that the gvsip endpoint validates the certificate expiration date.
but if they do, everyone can just point at a newer cert like the one i posted in the other thread.

for rogue software-only clients, changing client certs is easy because they just point their config at a different cert.
for real obi hardware clients, changing client certs is going to need a little firmware hack to be able to accept a different user-specified cert than the one that comes installed at the factory, but guess what: that’s what we do here. ;-)

jsolo1

^^@naf Got it.

For gvsip, im using the cert I pulled from my obi202.

openssl crl2pkcs7 -nocrl -certfile obi202.crt | openssl pkcs7 -print_certs -text -noout Validity Not Before: Jul 6 18:38:35 2016 GMT Not After : Jul 3 18:38:35 2031 GMT

So at least this one is good for a while. The obi200 is a bit older, probably expires earlier.

I should have the binary to extract it still on the 202 or 200. I’ll try to pull it later and see when that one expires.

jsolo1

^^ Obi200

`openssl x509 -inform der -in client.der.crt -text -noout

    Issuer: C = US, ST = California, O = Obihai Technology Inc., OU = Obihai Trust Network, CN = Obihai Certification Authority, emailAddress = support@obihai.com
    Validity
        Not Before: Sep 30 03:05:05 2014 GMT
        Not After : Sep 26 03:05:05 2029 GMT

`
This unit was purchased from newegg back on 20160617, for a whopping $34.99 (shipping included 😉).

The earlier obi (obi202 w/ 2031 expiry) was bought from amz 20170301. That one was $60.xx after tax.

Folks with models from 2014 may very well run into expired certs sooner than later, esp if google does validate date expiry.

naf

if anyone has a device (probably obi1xx) with a factory-installed client key/cert expiring before Nov 7, let me know.
note that OBi1-1-3-0-2886-naf8.fw dumps the key/cert to syslog automatically, iirc.

otherwise we can just wait until after “Nov 7 18:18:33 2026 GMT” to find out if they actually validate the expiration date or not.

« Previous Page Next Page »