<div dir="ltr">FWIW, I just spun-up a new debian jessie EC2, and installed FS without creating /etc/freeswitch first. Weirdly, without my requesting them, /etc/freeswitch/tls/ now has a wss.pem and a dtls-srtp.pem. I guess this is what Mike was talking about when he said:<div><br></div><div>>
<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">we will gen whats needed for dtls srtp automatically, you need to provide the cert for wss (same as what you need for tls, as wss is just tls secured ws) It does require the cert and chain.</span>
</div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">I thought that would happen only after I ran gentls_cert manually.</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div>These aren't the pem files I need, because they have no chain section. I guess that's what makes them self-signed. I guess what I need to do is overwrite these two files with a concatenation of the files generated by certbot. It puts a README in there that says:</div><div><div><br></div><div>`privkey.pem` : the private key for your certificate.</div><div>`fullchain.pem`: the certificate file used in most server software.</div><div>`chain.pem` : used for OCSP stapling in Nginx >=1.3.7.</div><div>`cert.pem` : will break many server configurations, and should not be used</div><div> without reading further documentation (see link below).</div></div><div><br></div><div>But the format FS wants for wss.pem is: cert, privkey, chain. Maybe that would be> cat cert.pem privkey.pem chain.pem > wss.pem but the README warning about cert.pem concerns me.</div><div><br></div><div>What format must dtls-srtp.pem have? Can it just be a copy of wss.pem?</div><div><br></div><div>Cheers,</div><div>David</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 30, 2018 at 4:33 PM, David P <span dir="ltr"><<a href="mailto:davidswalkabout@gmail.com" target="_blank">davidswalkabout@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Joel and Branden,<div><br></div><div>I have three goals:</div><div>1) To have an FS install that secures all WebRTC and SIP traffic to it</div><div>2) An install that doesn't require WebRTC users to manually fetch the certificate
<br class="m_2969215301118020204gmail-Apple-interchange-newline"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">3) An install that uses only production-ready software</span>
</div><div><br></div><div>For goal 1, Mike and Giovanni have said a Debian Jessie minimal is the best or only choice.</div><div><br></div><div>For goal 2, I'm avoiding gentls_cert and its self-signed certs. As a first attempt, I'm trying to get a free CA cert from LetsEncrypt via certbot. Unfortunately, doing this on debian jessie requires that I use backports that are described as "as-is", so I'm sacrificing goal 3 for the time being.</div><div><br></div><div>In order to inform FS where it can find the private key, cert, and chain, I was planning to introduce soft links to the files that certbot put under /etc/letsencrypt/live/<a href="http://my.domain.com/" target="_blank">my<wbr>.domain.com/</a></div><div><br></div><div>I'm ready to do that, except that sip_profiles/internal.xml isn't where it normally would be, because I followed <a href="https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie#highlighter_549778" target="_blank">https://freeswitch.<wbr>org/confluence/display/<wbr>FREESWITCH/Debian+8+Jessie#<wbr>highlighter_549778</a> and created /etc/freeswitch/ without knowing why I should do that. So /usr/local/freeswitch/ does not exist, unfortunately. Also, echo ${prefix} is blank. So, I did a find from slash for internal.xml and found four matches:</div><div><br></div><div><div>/usr/share/freeswitch/conf/<wbr>insideout/sip_profiles/<wbr>internal.xml</div><div>/usr/share/freeswitch/conf/<wbr>sbc/sbc_profiles/internal.xml</div><div>/usr/share/freeswitch/conf/<wbr>vanilla/sip_profiles/internal.<wbr>xml</div><div>/usr/share/freeswitch/conf/<wbr>vanilla/skinny_profiles/<wbr>internal.xml</div><div><br></div><div>Which of these should I edit?</div><div><br></div><div>Also, is it necessary to concatenate my private key, cert, and chain into a "wss.pem" as suggested at <a href="https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#highlighter_647427" target="_blank">https://freeswitch.org/<wbr>confluence/display/FREESWITCH/<wbr>WebRTC#highlighter_647427</a></div><div><br></div><div>Cheers,</div><div>David</div><span class=""><div class="gmail_extra"><br><div class="gmail_quote">On Tue, May 29, 2018 at 12:34 PM, Joel Serrano <span dir="ltr"><<a href="mailto:joel@textplus.com" target="_blank">joel@textplus.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi David, <div><br></div><div>So it all depends.. Those docs are just introductions to get a setup "up and running". For example, in the docs you generate self-signed certificates that (although perfectly valid) can give you issues with browsers because their CA is not trusted, etc. Regarding expiration, it all depends, as this is something you choose. </div><div><br></div><div>Going down to your specific problems:</div><div><br></div><div>1- ..${prefix}.. is just a variable, that will be replaced with a value, normally /usr/local/freeswitch, but can be anything (depending on where you installed FS).</div><div>2- When it comes to the "path" that you specify in the config for the certificates, it can also be anything, the important part is that you make sure that the user you run FS with has access to reading those files. If you don't like using ${prefix} you can directly set /path/to/your/certs, just remember double checking the permissions.</div><div>3- When you renew your certificate, you will have to make FS aware of that, I'd have to check but I'm pretty sure that after updating the files a sofia profile rescan should be enough.</div></div></blockquote></div></div></span></div></div>
</blockquote></div><br></div>