Thank you for your suggestion, Sergey. However, I found that introducing those two settings (in FSv10.4 on Debian10) made no difference; I still got just one candidate in FS's answer SDP and it's udp rather than tcp (for port 443)...

Before introducing
<X-PRE-PROCESS cmd="set" data="add_ice_candidates=true"/> in /etc/freeswitch/vars.xml
and
<action application="set" data="media_webrtc=true"/> in /etc/freeswitch/dialplan/mydialplan.xml
the browser receives Answer SDP containing only one ice candidate:
a=candidate:5500513041 1 udp 659136 35.xxx.yy.zzz 26928 typ host generation 0

After introducing those two config changes, and `fs_cli -x "reloadxml"`, the set of candidates in the answer the browser gets is the same:
a=candidate:4793838179 1 udp 659136 35.xxx.yy.zzz 19518 typ host generation 0

The reason I asked about supporting all media (and signaling) via port 443 is that some users are in firewalls that block all ports except 443 (or 80).

On Mon, Aug 10, 2020 at 5:14 AM <freeswitch-users-request@lists.freeswitch.org> wrote:

---------- Forwarded message ----------
From: Sergey Safarov <s.safarov@gmail.com>

You can offer ice for all calls from FreeSwitch without coturn

<X-PRE-PROCESS cmd="set" data="add_ice_candidates=true"/>

More details
https://freeswitch.org/confluence/display/FREESWITCH/NAT+Traversal#NATTraversal-FreeSWITCHBehindNAT

also, you can try the variable "media_webrtc=true"

On Sun, Aug 9, 2020 at 8:42 PM David P <davidswalkabout@gmail.com> wrote:
Can FS v1.10 be configured to handle SRTP of all calls via port 443?

This would allow us to stop using coturn, which is often too slow to provide a TLS relay candidate before browsers finish gathering ice candidates.