we will gen whats needed for dtls srtp automatically, you need to provide the cert for wss (same as what you need for tls, as wss is just tls secured ws) It does require the cert and chain. More info: https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... <https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCertificates> Mike
On May 24, 2018, at 12:23 PM, David P <davidswalkabout@gmail.com> wrote:
Thanks, Mike, I'll try another distro.
About verto, which I already serve under an AWS free non-exportable cert, does it need the gentls-generated CA root cert somewhere?
And do I need any more steps to secure the streamed media?
On Thu, 24 May 2018, 9:05 am Michael Jerris, <mike@jerris.com <mailto:mike@jerris.com>> wrote: Try something NOT ubuntu. Ubuntu disables some required stuff in their openssl making it unusable for webrtc at least in some versions.
On May 24, 2018, at 1:27 AM, David P <davidswalkabout@gmail.com <mailto:davidswalkabout@gmail.com>> wrote:
While waiting for suggestions, I tried more things. In particular, I tested whether gentls_cert was present in our FS install (which is at /opt/freeswitch/ on ubuntu).
It is present, but the CA root cert step writes to {prefix}/etc/freeswitch/tls/CA/ instead of {prefix}/conf/ssl/CA/. In particular, the root CA step generates:
etc/freeswitch/tls/ cafile.pem
etc/freeswitch/tls/CA/ cacert.pem cakey.pem config.tpl
And the server cert step generates:
etc/freeswitch/tls/ agent.pem
etc/freeswitch/tls/CA/ cacert.srl
Reviewing agent.pem shows it's fine: openssl x509 -noout -inform pem -text -in /opt/freeswitch/etc/freeswitch/tls/agent.pem
But it's owned by user root group root, so: cd /opt/freeswitch/etc/freeswitch/tls/ chmod 640 agent.pem CA/cacert.pem chown root.freeswitch agent.pem CA/cacert.pem
Then I edited /opt/freeswitch/etc/freeswitch/vars.xml to set internal_ssl_enable and external_ssl_enable to true.
Then I restarted FS. I checked the CLI and it shows "WS SETUP FAILED" repeatedly. *Any suggestion?*
Blazing ahead...then I exposed the public IP of the FS machine under a subdomain of the CA root cert's domain. (I used a wildcard subdomain for -org when generating both certs; maybe giving a wildcard this way is unnecessary or counterproductive.)
Now, the part that puzzles me: I'm already using a "real CA" cert in order to serve my verto client files over https from my DNS name, so browsers won't show security warnings. But I bet I need to have the same CA root cert installed in FS as I use in the webserver, right? I saw the note that commercial certs should work, but *it's not clear what steps to follow to install one*.
Cheers, David
On Tue, May 22, 2018 at 9:50 PM, David P <davidswalkabout@gmail.com <mailto:davidswalkabout@gmail.com>> wrote: We use conferences to allow a verto user to call and connect with an Asterisk channel. We would like to secure both signalling and media via TLS + SRTP, and I've read https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS <https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS> a few times to understand how to do this. Note that that page has a broken link: https://wiki.freeswitch.org/wiki/Secure_RTP <https://wiki.freeswitch.org/wiki/Secure_RTP>
First, is it still true that FS doesn't offer prebuilt installs (for Ubuntu) to support this kind of security?
Assuming that it must be compiled, I began to follow https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie <https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie> with the additional first step of: apt-get install libssl-dev
I soon ran into "Unable to locate package freeswitch-video-deps-most".
What should I try next?
Cheers, David