Re: [Freeswitch-users] Achieving TLS + SRTP for inbound calls
Thanks, Mike, I'll try another distro. About verto, which I already serve under an AWS free non-exportable cert, does it need the gentls-generated CA root cert somewhere? And do I need any more steps to secure the streamed media? On Thu, 24 May 2018, 9:05 am Michael Jerris, <mike@jerris.com> wrote:
Try something NOT ubuntu. Ubuntu disables some required stuff in their openssl making it unusable for webrtc at least in some versions.
On May 24, 2018, at 1:27 AM, David P <davidswalkabout@gmail.com> wrote:
While waiting for suggestions, I tried more things. In particular, I tested whether gentls_cert was present in our FS install (which is at /opt/freeswitch/ on ubuntu).
It is present, but the CA root cert step writes to {prefix}/etc/freeswitch/tls/CA/ instead of {prefix}/conf/ssl/CA/. In particular, the root CA step generates:
etc/freeswitch/tls/ cafile.pem
etc/freeswitch/tls/CA/ cacert.pem cakey.pem config.tpl
And the server cert step generates:
etc/freeswitch/tls/ agent.pem
etc/freeswitch/tls/CA/ cacert.srl
Reviewing agent.pem shows it's fine: openssl x509 -noout -inform pem -text -in /opt/freeswitch/etc/freeswitch/tls/agent.pem
But it's owned by user root group root, so: cd /opt/freeswitch/etc/freeswitch/tls/ chmod 640 agent.pem CA/cacert.pem chown root.freeswitch agent.pem CA/cacert.pem
Then I edited /opt/freeswitch/etc/freeswitch/vars.xml to set internal_ssl_enable and external_ssl_enable to true.
Then I restarted FS. I checked the CLI and it shows "WS SETUP FAILED" repeatedly. *Any suggestion?*
Blazing ahead...then I exposed the public IP of the FS machine under a subdomain of the CA root cert's domain. (I used a wildcard subdomain for -org when generating both certs; maybe giving a wildcard this way is unnecessary or counterproductive.)
Now, the part that puzzles me: I'm already using a "real CA" cert in order to serve my verto client files over https from my DNS name, so browsers won't show security warnings. But I bet I need to have the same CA root cert installed in FS as I use in the webserver, right? I saw the note that commercial certs should work, but *it's not clear what steps to follow to install one*.
Cheers, David
On Tue, May 22, 2018 at 9:50 PM, David P <davidswalkabout@gmail.com> wrote:
We use conferences to allow a verto user to call and connect with an Asterisk channel. We would like to secure both signalling and media via TLS + SRTP, and I've read https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS a few times to understand how to do this. Note that that page has a broken link: https://wiki.freeswitch.org/wiki/Secure_RTP
First, is it still true that FS doesn't offer prebuilt installs (for Ubuntu) to support this kind of security?
Assuming that it must be compiled, I began to follow https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie with the additional first step of: apt-get install libssl-dev
I soon ran into "Unable to locate package freeswitch-video-deps-most".
What should I try next?
Cheers, David
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
we will gen whats needed for dtls srtp automatically, you need to provide the cert for wss (same as what you need for tls, as wss is just tls secured ws) It does require the cert and chain. More info: https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... <https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCertificates> Mike
On May 24, 2018, at 12:23 PM, David P <davidswalkabout@gmail.com> wrote:
Thanks, Mike, I'll try another distro.
About verto, which I already serve under an AWS free non-exportable cert, does it need the gentls-generated CA root cert somewhere?
And do I need any more steps to secure the streamed media?
On Thu, 24 May 2018, 9:05 am Michael Jerris, <mike@jerris.com <mailto:mike@jerris.com>> wrote: Try something NOT ubuntu. Ubuntu disables some required stuff in their openssl making it unusable for webrtc at least in some versions.
On May 24, 2018, at 1:27 AM, David P <davidswalkabout@gmail.com <mailto:davidswalkabout@gmail.com>> wrote:
While waiting for suggestions, I tried more things. In particular, I tested whether gentls_cert was present in our FS install (which is at /opt/freeswitch/ on ubuntu).
It is present, but the CA root cert step writes to {prefix}/etc/freeswitch/tls/CA/ instead of {prefix}/conf/ssl/CA/. In particular, the root CA step generates:
etc/freeswitch/tls/ cafile.pem
etc/freeswitch/tls/CA/ cacert.pem cakey.pem config.tpl
And the server cert step generates:
etc/freeswitch/tls/ agent.pem
etc/freeswitch/tls/CA/ cacert.srl
Reviewing agent.pem shows it's fine: openssl x509 -noout -inform pem -text -in /opt/freeswitch/etc/freeswitch/tls/agent.pem
But it's owned by user root group root, so: cd /opt/freeswitch/etc/freeswitch/tls/ chmod 640 agent.pem CA/cacert.pem chown root.freeswitch agent.pem CA/cacert.pem
Then I edited /opt/freeswitch/etc/freeswitch/vars.xml to set internal_ssl_enable and external_ssl_enable to true.
Then I restarted FS. I checked the CLI and it shows "WS SETUP FAILED" repeatedly. *Any suggestion?*
Blazing ahead...then I exposed the public IP of the FS machine under a subdomain of the CA root cert's domain. (I used a wildcard subdomain for -org when generating both certs; maybe giving a wildcard this way is unnecessary or counterproductive.)
Now, the part that puzzles me: I'm already using a "real CA" cert in order to serve my verto client files over https from my DNS name, so browsers won't show security warnings. But I bet I need to have the same CA root cert installed in FS as I use in the webserver, right? I saw the note that commercial certs should work, but *it's not clear what steps to follow to install one*.
Cheers, David
On Tue, May 22, 2018 at 9:50 PM, David P <davidswalkabout@gmail.com <mailto:davidswalkabout@gmail.com>> wrote: We use conferences to allow a verto user to call and connect with an Asterisk channel. We would like to secure both signalling and media via TLS + SRTP, and I've read https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS <https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS> a few times to understand how to do this. Note that that page has a broken link: https://wiki.freeswitch.org/wiki/Secure_RTP <https://wiki.freeswitch.org/wiki/Secure_RTP>
First, is it still true that FS doesn't offer prebuilt installs (for Ubuntu) to support this kind of security?
Assuming that it must be compiled, I began to follow https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie <https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie> with the additional first step of: apt-get install libssl-dev
I soon ran into "Unable to locate package freeswitch-video-deps-most".
What should I try next?
Cheers, David
I've tried working through the page you provided, but I've encountered some loose ends. First, in order to use a CA cert, I installed certbot alongside Apache on Ubuntu16.04. This is an AWS EC2, so I don't have many options on which distro I can use. You recommended against Ubuntu; would you elaborate why? This Apache is on the same machine as FS. I no longer serve verto files from Apache (they're now in S3/CloudFront), but I suspect Apache may still be needed to serve the cert for wss. But FS can probably do that itself. Anyway, https://www.ssllabs.com/ssltest/analyze.html?d=my.domain.com shows the cert is reachable and valid. On disk, they're at: /etc/letsencrypt/live/my.domain.com/fullchain.pem /etc/letsencrypt/live/my.domain.com/privkey.pem Do these need to be renamed for FS to find them? https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... says I should edit sip_profiles/internal.xml so that <param name="tls-cert-dir" value="(path to certs)"/> <param name="wss-binding" value=":7443"/> Should (path to certs) be replaced with /etc/letsencrypt/live/ my.domain.com/ ? Even though I haven't finished the config above, this test suggests something is working: sudo /opt/freeswitch/bin/fs_cli -x 'sofia status profile internal' | grep WSS-BIND-URL WSS-BIND-URL sips:mod_sofia@(private EC2 IP):7443;transport=wss Later steps say to create a wss.pem under /usr/local/freeswitch/certs/wss.pem but there is no certs/ after FS install; am I supposed to mkdir it? Later steps also say to create conf/autoload_configs/verto.conf.xml but there is no conf/ Should I mkdir it? David On Thu, May 24, 2018 at 9:32 AM, Michael Jerris <mike@jerris.com> wrote:
we will gen whats needed for dtls srtp automatically, you need to provide the cert for wss (same as what you need for tls, as wss is just tls secured ws) It does require the cert and chain. More info:
https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC- InstallCertificates
Mike
On May 24, 2018, at 12:23 PM, David P <davidswalkabout@gmail.com> wrote:
Thanks, Mike, I'll try another distro.
About verto, which I already serve under an AWS free non-exportable cert, does it need the gentls-generated CA root cert somewhere?
And do I need any more steps to secure the streamed media?
Use debian 8 jessie 64 bit minimal server install On Sun, May 27, 2018, 10:57 David P <davidswalkabout@gmail.com> wrote:
I've tried working through the page you provided, but I've encountered some loose ends. First, in order to use a CA cert, I installed certbot alongside Apache on Ubuntu16.04. This is an AWS EC2, so I don't have many options on which distro I can use. You recommended against Ubuntu; would you elaborate why?
This Apache is on the same machine as FS. I no longer serve verto files from Apache (they're now in S3/CloudFront), but I suspect Apache may still be needed to serve the cert for wss. But FS can probably do that itself. Anyway, https://www.ssllabs.com/ssltest/analyze.html?d=my.domain.com shows the cert is reachable and valid. On disk, they're at: /etc/letsencrypt/live/my.domain.com/fullchain.pem /etc/letsencrypt/live/my.domain.com/privkey.pem
Do these need to be renamed for FS to find them?
https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... says I should edit sip_profiles/internal.xml so that <param name="tls-cert-dir" value="(path to certs)"/> <param name="wss-binding" value=":7443"/>
Should (path to certs) be replaced with /etc/letsencrypt/live/ my.domain.com/ ?
Even though I haven't finished the config above, this test suggests something is working:
sudo /opt/freeswitch/bin/fs_cli -x 'sofia status profile internal' | grep WSS-BIND-URL WSS-BIND-URL sips:mod_sofia@(private EC2 IP):7443;transport=wss
Later steps say to create a wss.pem under /usr/local/freeswitch/certs/wss.pem but there is no certs/ after FS install; am I supposed to mkdir it?
Later steps also say to create conf/autoload_configs/verto.conf.xml but there is no conf/ Should I mkdir it?
David
On Thu, May 24, 2018 at 9:32 AM, Michael Jerris <mike@jerris.com> wrote:
we will gen whats needed for dtls srtp automatically, you need to provide the cert for wss (same as what you need for tls, as wss is just tls secured ws) It does require the cert and chain. More info:
https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe...
Mike
On May 24, 2018, at 12:23 PM, David P <davidswalkabout@gmail.com> wrote:
Thanks, Mike, I'll try another distro.
About verto, which I already serve under an AWS free non-exportable cert, does it need the gentls-generated CA root cert somewhere?
And do I need any more steps to secure the streamed media?
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
On Sun, 27 May 2018, 9:46 am Giovanni Maruzzelli, <gmaruzz@gmail.com> wrote:
Use debian 8 jessie 64 bit minimal server install
I haven't seen that as an EC2 image option. Also, does gentls create a true, browser-trusted cert like certbot/LetsEncrypt does? And if so, how does it get renewed?
On Sun, May 27, 2018 at 9:25 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Use debian 8 jessie 64 bit minimal server install
Thanks, Giovanni (and Mike). I found an EC2 AMI for debian jessie. Then, when I follow https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... I get to: ./configure -C which fails with: error: "Cannot build without libtiff (does your system require a libtiff-devel package?)" I tried: sudo apt-get install libtiff-tools and then re-running configure, but it has the same result. Googling this error yields a single result, an FS bug report: https://freeswitch.org/jira/browse/FS-10556 Please let me know how to resolve this dependency. The obvious thing to try (i.e. sudo apt-get install libtiff-devel) didn't work.
- Trash your aws instance - Start with a new jessie 64 sefver i stance (jessie!!!) - search in freeswitch.org/confluence about jessie - follow the steps to "install freeswit h on jessie" (copy and paste) - profit! Do not try anything advanced until you know the basics. -giovanni On Mon, May 28, 2018, 06:16 David P <davidswalkabout@gmail.com> wrote:
On Sun, May 27, 2018 at 9:25 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
Use debian 8 jessie 64 bit minimal server install
Thanks, Giovanni (and Mike).
I found an EC2 AMI for debian jessie. Then, when I follow https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... I get to:
./configure -C
which fails with:
error: "Cannot build without libtiff (does your system require a libtiff-devel package?)"
I tried:
sudo apt-get install libtiff-tools
and then re-running configure, but it has the same result. Googling this error yields a single result, an FS bug report:
https://freeswitch.org/jira/browse/FS-10556
Please let me know how to resolve this dependency. The obvious thing to try (i.e. sudo apt-get install libtiff-devel) didn't work. _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Ok, Giovanni. Using your confluence page's search box (not google) for jessie yields one match: https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie I launched a debian jessie EC2, then followed section "Installing From Debian Packages" at the link above. In particular, I followed the advice in the comment about creating a "freeswitch" folder under /etc before the apt-get to install freeswitch. There were no errors. Now the only thing under /etc/freeswitch/ is an empty tls/ folder. Is this expected? Next, to install a CA cert for use by verto and SIP clients, do I follow steps 1-4 at https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS ? If so, what is {prefix} for this kind of FS install? On Mon, May 28, 2018 at 8:03 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
- Trash your aws instance - Start with a new jessie 64 sefver i stance (jessie!!!) - search in freeswitch.org/confluence about jessie - follow the steps to "install freeswit h on jessie" (copy and paste) - profit!
Do not try anything advanced until you know the basics.
-giovanni
To be a little more specific, I think you would suggest following https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... after installing fs on jessie. However, the section there about "Install Certificates" assumes there is already a cert, key, and chain on disk that can be concatenated into a wss.pem. But it seems to me those files don't exist after installing fs on jessie; in particular, /etc/freeswitch/tls/ is empty. On Mon, May 28, 2018 at 9:00 PM, David P <davidswalkabout@gmail.com> wrote:
Ok, Giovanni. Using your confluence page's search box (not google) for jessie yields one match:
https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie
I launched a debian jessie EC2, then followed section "Installing From Debian Packages" at the link above. In particular, I followed the advice in the comment about creating a "freeswitch" folder under /etc before the apt-get to install freeswitch. There were no errors.
Now the only thing under /etc/freeswitch/ is an empty tls/ folder. Is this expected?
Next, to install a CA cert for use by verto and SIP clients, do I follow steps 1-4 at https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS ? If so, what is {prefix} for this kind of FS install?
On Mon, May 28, 2018 at 8:03 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
- Trash your aws instance - Start with a new jessie 64 sefver i stance (jessie!!!) - search in freeswitch.org/confluence about jessie - follow the steps to "install freeswit h on jessie" (copy and paste) - profit!
Do not try anything advanced until you know the basics.
-giovanni
Hi David, Have a look at: https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS You have information on how to generate the certificates.. On Mon, May 28, 2018 at 9:46 PM, David P <davidswalkabout@gmail.com> wrote:
To be a little more specific, I think you would suggest following https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC- InstallCertificates after installing fs on jessie. However, the section there about "Install Certificates" assumes there is already a cert, key, and chain on disk that can be concatenated into a wss.pem. But it seems to me those files don't exist after installing fs on jessie; in particular, /etc/freeswitch/tls/ is empty.
On Mon, May 28, 2018 at 9:00 PM, David P <davidswalkabout@gmail.com> wrote:
Ok, Giovanni. Using your confluence page's search box (not google) for jessie yields one match:
https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie
I launched a debian jessie EC2, then followed section "Installing From Debian Packages" at the link above. In particular, I followed the advice in the comment about creating a "freeswitch" folder under /etc before the apt-get to install freeswitch. There were no errors.
Now the only thing under /etc/freeswitch/ is an empty tls/ folder. Is this expected?
Next, to install a CA cert for use by verto and SIP clients, do I follow steps 1-4 at https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS ? If so, what is {prefix} for this kind of FS install?
On Mon, May 28, 2018 at 8:03 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
- Trash your aws instance - Start with a new jessie 64 sefver i stance (jessie!!!) - search in freeswitch.org/confluence about jessie - follow the steps to "install freeswit h on jessie" (copy and paste) - profit!
Do not try anything advanced until you know the basics.
-giovanni
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Joel, please have a look at my first post yesterday in this thread in which I ask about that doc. In particular, what is {prefix} for a jessie install? And if I follow steps 1-4, how do I renew the cert later? On Tue, 29 May 2018, 11:28 am Joel Serrano, <joel@textplus.com> wrote:
Hi David,
Have a look at: https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS
You have information on how to generate the certificates..
On Mon, May 28, 2018 at 9:46 PM, David P <davidswalkabout@gmail.com> wrote:
To be a little more specific, I think you would suggest following https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... after installing fs on jessie. However, the section there about "Install Certificates" assumes there is already a cert, key, and chain on disk that can be concatenated into a wss.pem. But it seems to me those files don't exist after installing fs on jessie; in particular, /etc/freeswitch/tls/ is empty.
On Mon, May 28, 2018 at 9:00 PM, David P <davidswalkabout@gmail.com> wrote:
Ok, Giovanni. Using your confluence page's search box (not google) for jessie yields one match:
https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie
I launched a debian jessie EC2, then followed section "Installing From Debian Packages" at the link above. In particular, I followed the advice in the comment about creating a "freeswitch" folder under /etc before the apt-get to install freeswitch. There were no errors.
Now the only thing under /etc/freeswitch/ is an empty tls/ folder. Is this expected?
Next, to install a CA cert for use by verto and SIP clients, do I follow steps 1-4 at https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS ? If so, what is {prefix} for this kind of FS install?
On Mon, May 28, 2018 at 8:03 AM, Giovanni Maruzzelli <gmaruzz@gmail.com> wrote:
- Trash your aws instance - Start with a new jessie 64 sefver i stance (jessie!!!) - search in freeswitch.org/confluence about jessie - follow the steps to "install freeswit h on jessie" (copy and paste) - profit!
Do not try anything advanced until you know the basics.
-giovanni
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi David, So it all depends.. Those docs are just introductions to get a setup "up and running". For example, in the docs you generate self-signed certificates that (although perfectly valid) can give you issues with browsers because their CA is not trusted, etc. Regarding expiration, it all depends, as this is something you choose. Going down to your specific problems: 1- ..${prefix}.. is just a variable, that will be replaced with a value, normally /usr/local/freeswitch, but can be anything (depending on where you installed FS). 2- When it comes to the "path" that you specify in the config for the certificates, it can also be anything, the important part is that you make sure that the user you run FS with has access to reading those files. If you don't like using ${prefix} you can directly set /path/to/your/certs, just remember double checking the permissions. 3- When you renew your certificate, you will have to make FS aware of that, I'd have to check but I'm pretty sure that after updating the files a sofia profile rescan should be enough. On Tue, May 29, 2018 at 11:48 AM, David P <davidswalkabout@gmail.com> wrote:
Hi Joel, please have a look at my first post yesterday in this thread in which I ask about that doc. In particular, what is {prefix} for a jessie install? And if I follow steps 1-4, how do I renew the cert later?
On Tue, 29 May 2018, 11:28 am Joel Serrano, <joel@textplus.com> wrote:
Hi David,
Have a look at: https://freeswitch.org/confluence/display/FREESWITCH/ SIP+TLS
You have information on how to generate the certificates..
On Mon, May 28, 2018 at 9:46 PM, David P <davidswalkabout@gmail.com> wrote:
To be a little more specific, I think you would suggest following https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC- InstallCertificates after installing fs on jessie. However, the section there about "Install Certificates" assumes there is already a cert, key, and chain on disk that can be concatenated into a wss.pem. But it seems to me those files don't exist after installing fs on jessie; in particular, /etc/freeswitch/tls/ is empty.
On Mon, May 28, 2018 at 9:00 PM, David P <davidswalkabout@gmail.com> wrote:
Ok, Giovanni. Using your confluence page's search box (not google) for jessie yields one match:
https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie
I launched a debian jessie EC2, then followed section "Installing From Debian Packages" at the link above. In particular, I followed the advice in the comment about creating a "freeswitch" folder under /etc before the apt-get to install freeswitch. There were no errors.
Now the only thing under /etc/freeswitch/ is an empty tls/ folder. Is this expected?
Next, to install a CA cert for use by verto and SIP clients, do I follow steps 1-4 at https://freeswitch.org/ confluence/display/FREESWITCH/SIP+TLS ? If so, what is {prefix} for this kind of FS install?
On Mon, May 28, 2018 at 8:03 AM, Giovanni Maruzzelli <gmaruzz@gmail.com
wrote:
- Trash your aws instance - Start with a new jessie 64 sefver i stance (jessie!!!) - search in freeswitch.org/confluence about jessie - follow the steps to "install freeswit h on jessie" (copy and paste) - profit!
Do not try anything advanced until you know the basics.
-giovanni
____________________________________________________________ _____________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Hi Joel and Branden, I have three goals: 1) To have an FS install that secures all WebRTC and SIP traffic to it 2) An install that doesn't require WebRTC users to manually fetch the certificate 3) An install that uses only production-ready software For goal 1, Mike and Giovanni have said a Debian Jessie minimal is the best or only choice. For goal 2, I'm avoiding gentls_cert and its self-signed certs. As a first attempt, I'm trying to get a free CA cert from LetsEncrypt via certbot. Unfortunately, doing this on debian jessie requires that I use backports that are described as "as-is", so I'm sacrificing goal 3 for the time being. In order to inform FS where it can find the private key, cert, and chain, I was planning to introduce soft links to the files that certbot put under /etc/letsencrypt/live/my.domain.com/ I'm ready to do that, except that sip_profiles/internal.xml isn't where it normally would be, because I followed https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie#highlig... and created /etc/freeswitch/ without knowing why I should do that. So /usr/local/freeswitch/ does not exist, unfortunately. Also, echo ${prefix} is blank. So, I did a find from slash for internal.xml and found four matches: /usr/share/freeswitch/conf/insideout/sip_profiles/internal.xml /usr/share/freeswitch/conf/sbc/sbc_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/sip_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/skinny_profiles/internal.xml Which of these should I edit? Also, is it necessary to concatenate my private key, cert, and chain into a "wss.pem" as suggested at https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#highlighter_6474... Cheers, David On Tue, May 29, 2018 at 12:34 PM, Joel Serrano <joel@textplus.com> wrote:
Hi David,
So it all depends.. Those docs are just introductions to get a setup "up and running". For example, in the docs you generate self-signed certificates that (although perfectly valid) can give you issues with browsers because their CA is not trusted, etc. Regarding expiration, it all depends, as this is something you choose.
Going down to your specific problems:
1- ..${prefix}.. is just a variable, that will be replaced with a value, normally /usr/local/freeswitch, but can be anything (depending on where you installed FS). 2- When it comes to the "path" that you specify in the config for the certificates, it can also be anything, the important part is that you make sure that the user you run FS with has access to reading those files. If you don't like using ${prefix} you can directly set /path/to/your/certs, just remember double checking the permissions. 3- When you renew your certificate, you will have to make FS aware of that, I'd have to check but I'm pretty sure that after updating the files a sofia profile rescan should be enough.
Hi David, I don't understand your issues with goal 2 using let's encrypt, that option certainly works and is widely used. What problems are you facing? If you don't have enough confidence on backports you can always download the latest stable release of certbot: https://certbot.eff.org/lets-encrypt/pip-other *Install* *Since it doesn't seem like your operating system has a packaged version of Certbot, you should use our certbot-auto script to get a copy:* *wget https://dl.eff.org/certbot-auto <https://dl.eff.org/certbot-auto>* *chmod a+x certbot-auto* But, Certbot themselves are recommending installation on debian jessie using the backports repository: *Install* *Since Certbot is packaged for your system, all you'll need to do is apt-get the following packages.* *First you'll have to follow the instructions here to enable the Jessie backports repo, if you have not already done so. Then run:* *$ sudo apt-get install certbot -t jessie-backports* What are your concerns regarding using certbot installed from jessie-backports? Going back to the topic, if you created /etc/freeswitch before installing the packages, the installer will not deploy the vanilla config. I assume you installed from packages (as it's the recommended easy way), if so, uninstall them, delete /etc/freeswitch, then install again: 1- Add signing key and repo (only done once, you should have already done this): wget -O - https://files.freeswitch.org/repo/deb/debian/freeswitch_archive_g0.pub | apt-key add - echo "deb http://files.freeswitch.org/repo/deb/freeswitch-1.6/ jessie main"
/etc/apt/sources.list.d/freeswitch.list
2- Remove current installation: apt-get purge freeswitch* 3- Make sure /etc/freeswitch doesn't exist: rm -rf /etc/freeswitch 4- Install freeswitch: apt-get update && apt-get install -y freeswitch-meta-all Done! You should have /etc/freeswitch deployed, and you can start doing your updates in /etc/freeswitch/sip_profiles etc... On Wed, May 30, 2018 at 4:33 PM, David P <davidswalkabout@gmail.com> wrote:
Hi Joel and Branden,
I have three goals: 1) To have an FS install that secures all WebRTC and SIP traffic to it 2) An install that doesn't require WebRTC users to manually fetch the certificate 3) An install that uses only production-ready software
For goal 1, Mike and Giovanni have said a Debian Jessie minimal is the best or only choice.
For goal 2, I'm avoiding gentls_cert and its self-signed certs. As a first attempt, I'm trying to get a free CA cert from LetsEncrypt via certbot. Unfortunately, doing this on debian jessie requires that I use backports that are described as "as-is", so I'm sacrificing goal 3 for the time being.
In order to inform FS where it can find the private key, cert, and chain, I was planning to introduce soft links to the files that certbot put under /etc/letsencrypt/live/my.domain.com/
I'm ready to do that, except that sip_profiles/internal.xml isn't where it normally would be, because I followed https://freeswitch. org/confluence/display/FREESWITCH/Debian+8+Jessie#highlighter_549778 and created /etc/freeswitch/ without knowing why I should do that. So /usr/local/freeswitch/ does not exist, unfortunately. Also, echo ${prefix} is blank. So, I did a find from slash for internal.xml and found four matches:
/usr/share/freeswitch/conf/insideout/sip_profiles/internal.xml /usr/share/freeswitch/conf/sbc/sbc_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/sip_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/skinny_profiles/internal.xml
Which of these should I edit?
Also, is it necessary to concatenate my private key, cert, and chain into a "wss.pem" as suggested at https://freeswitch.org/ confluence/display/FREESWITCH/WebRTC#highlighter_647427
Cheers, David
On Tue, May 29, 2018 at 12:34 PM, Joel Serrano <joel@textplus.com> wrote:
Hi David,
So it all depends.. Those docs are just introductions to get a setup "up and running". For example, in the docs you generate self-signed certificates that (although perfectly valid) can give you issues with browsers because their CA is not trusted, etc. Regarding expiration, it all depends, as this is something you choose.
Going down to your specific problems:
1- ..${prefix}.. is just a variable, that will be replaced with a value, normally /usr/local/freeswitch, but can be anything (depending on where you installed FS). 2- When it comes to the "path" that you specify in the config for the certificates, it can also be anything, the important part is that you make sure that the user you run FS with has access to reading those files. If you don't like using ${prefix} you can directly set /path/to/your/certs, just remember double checking the permissions. 3- When you renew your certificate, you will have to make FS aware of that, I'd have to check but I'm pretty sure that after updating the files a sofia profile rescan should be enough.
_________________________________________________________________________ Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
Hi Joel, I'm on mobile now, but when I looked at the certbot install page for debian-jessie manual install, it links to backports page, and that page warns it's not prod-ready, IIRC. My EC2 is already in the state described by your steps. The question is how to create wss.pem (and dtls-srtp.pem?) from the pem's installed by certbot. Cheers, David On Thu, 31 May 2018, 9:55 am Joel Serrano, <joel@textplus.com> wrote:
Hi David,
I don't understand your issues with goal 2 using let's encrypt, that option certainly works and is widely used. What problems are you facing? If you don't have enough confidence on backports you can always download the latest stable release of certbot: https://certbot.eff.org/lets-encrypt/pip-other
*Install* *Since it doesn't seem like your operating system has a packaged version of Certbot, you should use our certbot-auto script to get a copy:*
*wget https://dl.eff.org/certbot-auto <https://dl.eff.org/certbot-auto>* *chmod a+x certbot-auto*
But, Certbot themselves are recommending installation on debian jessie using the backports repository:
*Install* *Since Certbot is packaged for your system, all you'll need to do is apt-get the following packages.*
*First you'll have to follow the instructions here to enable the Jessie backports repo, if you have not already done so. Then run:*
*$ sudo apt-get install certbot -t jessie-backports*
What are your concerns regarding using certbot installed from jessie-backports?
Going back to the topic, if you created /etc/freeswitch before installing the packages, the installer will not deploy the vanilla config.
I assume you installed from packages (as it's the recommended easy way), if so, uninstall them, delete /etc/freeswitch, then install again:
1- Add signing key and repo (only done once, you should have already done this):
wget -O - https://files.freeswitch.org/repo/deb/debian/freeswitch_archive_g0.pub | apt-key add - echo "deb http://files.freeswitch.org/repo/deb/freeswitch-1.6/ jessie main" > /etc/apt/sources.list.d/freeswitch.list
2- Remove current installation:
apt-get purge freeswitch*
3- Make sure /etc/freeswitch doesn't exist:
rm -rf /etc/freeswitch
4- Install freeswitch:
apt-get update && apt-get install -y freeswitch-meta-all
Done!
You should have /etc/freeswitch deployed, and you can start doing your updates in /etc/freeswitch/sip_profiles etc...
On Wed, May 30, 2018 at 4:33 PM, David P <davidswalkabout@gmail.com> wrote:
Hi Joel and Branden,
I have three goals: 1) To have an FS install that secures all WebRTC and SIP traffic to it 2) An install that doesn't require WebRTC users to manually fetch the certificate 3) An install that uses only production-ready software
For goal 1, Mike and Giovanni have said a Debian Jessie minimal is the best or only choice.
For goal 2, I'm avoiding gentls_cert and its self-signed certs. As a first attempt, I'm trying to get a free CA cert from LetsEncrypt via certbot. Unfortunately, doing this on debian jessie requires that I use backports that are described as "as-is", so I'm sacrificing goal 3 for the time being.
In order to inform FS where it can find the private key, cert, and chain, I was planning to introduce soft links to the files that certbot put under /etc/letsencrypt/live/my.domain.com/
I'm ready to do that, except that sip_profiles/internal.xml isn't where it normally would be, because I followed https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie#highlig... and created /etc/freeswitch/ without knowing why I should do that. So /usr/local/freeswitch/ does not exist, unfortunately. Also, echo ${prefix} is blank. So, I did a find from slash for internal.xml and found four matches:
/usr/share/freeswitch/conf/insideout/sip_profiles/internal.xml /usr/share/freeswitch/conf/sbc/sbc_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/sip_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/skinny_profiles/internal.xml
Which of these should I edit?
Also, is it necessary to concatenate my private key, cert, and chain into a "wss.pem" as suggested at https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#highlighter_6474...
Cheers, David
On Tue, May 29, 2018 at 12:34 PM, Joel Serrano <joel@textplus.com> wrote:
Hi David,
So it all depends.. Those docs are just introductions to get a setup "up and running". For example, in the docs you generate self-signed certificates that (although perfectly valid) can give you issues with browsers because their CA is not trusted, etc. Regarding expiration, it all depends, as this is something you choose.
Going down to your specific problems:
1- ..${prefix}.. is just a variable, that will be replaced with a value, normally /usr/local/freeswitch, but can be anything (depending on where you installed FS). 2- When it comes to the "path" that you specify in the config for the certificates, it can also be anything, the important part is that you make sure that the user you run FS with has access to reading those files. If you don't like using ${prefix} you can directly set /path/to/your/certs, just remember double checking the permissions. 3- When you renew your certificate, you will have to make FS aware of that, I'd have to check but I'm pretty sure that after updating the files a sofia profile rescan should be enough.
_________________________________________________________________________ Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
_________________________________________________________________________ Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
Hi David, The order to create the .pem file would be: private-key certificate intermediate1 intermediate...X On Thu, May 31, 2018 at 15:40 David P <davidswalkabout@gmail.com> wrote:
Hi Joel,
I'm on mobile now, but when I looked at the certbot install page for debian-jessie manual install, it links to backports page, and that page warns it's not prod-ready, IIRC.
My EC2 is already in the state described by your steps. The question is how to create wss.pem (and dtls-srtp.pem?) from the pem's installed by certbot.
Cheers, David
On Thu, 31 May 2018, 9:55 am Joel Serrano, <joel@textplus.com> wrote:
Hi David,
I don't understand your issues with goal 2 using let's encrypt, that option certainly works and is widely used. What problems are you facing? If you don't have enough confidence on backports you can always download the latest stable release of certbot: https://certbot.eff.org/lets-encrypt/pip-other
*Install* *Since it doesn't seem like your operating system has a packaged version of Certbot, you should use our certbot-auto script to get a copy:*
*wget https://dl.eff.org/certbot-auto <https://dl.eff.org/certbot-auto>* *chmod a+x certbot-auto*
But, Certbot themselves are recommending installation on debian jessie using the backports repository:
*Install* *Since Certbot is packaged for your system, all you'll need to do is apt-get the following packages.*
*First you'll have to follow the instructions here to enable the Jessie backports repo, if you have not already done so. Then run:*
*$ sudo apt-get install certbot -t jessie-backports*
What are your concerns regarding using certbot installed from jessie-backports?
Going back to the topic, if you created /etc/freeswitch before installing the packages, the installer will not deploy the vanilla config.
I assume you installed from packages (as it's the recommended easy way), if so, uninstall them, delete /etc/freeswitch, then install again:
1- Add signing key and repo (only done once, you should have already done this):
wget -O - https://files.freeswitch.org/repo/deb/debian/freeswitch_archive_g0.pub | apt-key add - echo "deb http://files.freeswitch.org/repo/deb/freeswitch-1.6/ jessie main" > /etc/apt/sources.list.d/freeswitch.list
2- Remove current installation:
apt-get purge freeswitch*
3- Make sure /etc/freeswitch doesn't exist:
rm -rf /etc/freeswitch
4- Install freeswitch:
apt-get update && apt-get install -y freeswitch-meta-all
Done!
You should have /etc/freeswitch deployed, and you can start doing your updates in /etc/freeswitch/sip_profiles etc...
On Wed, May 30, 2018 at 4:33 PM, David P <davidswalkabout@gmail.com> wrote:
Hi Joel and Branden,
I have three goals: 1) To have an FS install that secures all WebRTC and SIP traffic to it 2) An install that doesn't require WebRTC users to manually fetch the certificate 3) An install that uses only production-ready software
For goal 1, Mike and Giovanni have said a Debian Jessie minimal is the best or only choice.
For goal 2, I'm avoiding gentls_cert and its self-signed certs. As a first attempt, I'm trying to get a free CA cert from LetsEncrypt via certbot. Unfortunately, doing this on debian jessie requires that I use backports that are described as "as-is", so I'm sacrificing goal 3 for the time being.
In order to inform FS where it can find the private key, cert, and chain, I was planning to introduce soft links to the files that certbot put under /etc/letsencrypt/live/my.domain.com/
I'm ready to do that, except that sip_profiles/internal.xml isn't where it normally would be, because I followed https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie#highlig... and created /etc/freeswitch/ without knowing why I should do that. So /usr/local/freeswitch/ does not exist, unfortunately. Also, echo ${prefix} is blank. So, I did a find from slash for internal.xml and found four matches:
/usr/share/freeswitch/conf/insideout/sip_profiles/internal.xml /usr/share/freeswitch/conf/sbc/sbc_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/sip_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/skinny_profiles/internal.xml
Which of these should I edit?
Also, is it necessary to concatenate my private key, cert, and chain into a "wss.pem" as suggested at https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#highlighter_6474...
Cheers, David
On Tue, May 29, 2018 at 12:34 PM, Joel Serrano <joel@textplus.com> wrote:
Hi David,
So it all depends.. Those docs are just introductions to get a setup "up and running". For example, in the docs you generate self-signed certificates that (although perfectly valid) can give you issues with browsers because their CA is not trusted, etc. Regarding expiration, it all depends, as this is something you choose.
Going down to your specific problems:
1- ..${prefix}.. is just a variable, that will be replaced with a value, normally /usr/local/freeswitch, but can be anything (depending on where you installed FS). 2- When it comes to the "path" that you specify in the config for the certificates, it can also be anything, the important part is that you make sure that the user you run FS with has access to reading those files. If you don't like using ${prefix} you can directly set /path/to/your/certs, just remember double checking the permissions. 3- When you renew your certificate, you will have to make FS aware of that, I'd have to check but I'm pretty sure that after updating the files a sofia profile rescan should be enough.
_________________________________________________________________________ Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
_________________________________________________________________________ Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
_________________________________________________________________________ Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
FWIW, I just spun-up a new debian jessie EC2, and installed FS without creating /etc/freeswitch first. Weirdly, without my requesting them, /etc/freeswitch/tls/ now has a wss.pem and a dtls-srtp.pem. I guess this is what Mike was talking about when he said:
we will gen whats needed for dtls srtp automatically, you need to provide the cert for wss (same as what you need for tls, as wss is just tls secured ws) It does require the cert and chain.
I thought that would happen only after I ran gentls_cert manually. These aren't the pem files I need, because they have no chain section. I guess that's what makes them self-signed. I guess what I need to do is overwrite these two files with a concatenation of the files generated by certbot. It puts a README in there that says: `privkey.pem` : the private key for your certificate. `fullchain.pem`: the certificate file used in most server software. `chain.pem` : used for OCSP stapling in Nginx >=1.3.7. `cert.pem` : will break many server configurations, and should not be used without reading further documentation (see link below). But the format FS wants for wss.pem is: cert, privkey, chain. Maybe that would be> cat cert.pem privkey.pem chain.pem > wss.pem but the README warning about cert.pem concerns me. What format must dtls-srtp.pem have? Can it just be a copy of wss.pem? Cheers, David On Wed, May 30, 2018 at 4:33 PM, David P <davidswalkabout@gmail.com> wrote:
Hi Joel and Branden,
I have three goals: 1) To have an FS install that secures all WebRTC and SIP traffic to it 2) An install that doesn't require WebRTC users to manually fetch the certificate 3) An install that uses only production-ready software
For goal 1, Mike and Giovanni have said a Debian Jessie minimal is the best or only choice.
For goal 2, I'm avoiding gentls_cert and its self-signed certs. As a first attempt, I'm trying to get a free CA cert from LetsEncrypt via certbot. Unfortunately, doing this on debian jessie requires that I use backports that are described as "as-is", so I'm sacrificing goal 3 for the time being.
In order to inform FS where it can find the private key, cert, and chain, I was planning to introduce soft links to the files that certbot put under /etc/letsencrypt/live/my.domain.com/
I'm ready to do that, except that sip_profiles/internal.xml isn't where it normally would be, because I followed https://freeswitch. org/confluence/display/FREESWITCH/Debian+8+Jessie#highlighter_549778 and created /etc/freeswitch/ without knowing why I should do that. So /usr/local/freeswitch/ does not exist, unfortunately. Also, echo ${prefix} is blank. So, I did a find from slash for internal.xml and found four matches:
/usr/share/freeswitch/conf/insideout/sip_profiles/internal.xml /usr/share/freeswitch/conf/sbc/sbc_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/sip_profiles/internal.xml /usr/share/freeswitch/conf/vanilla/skinny_profiles/internal.xml
Which of these should I edit?
Also, is it necessary to concatenate my private key, cert, and chain into a "wss.pem" as suggested at https://freeswitch.org/ confluence/display/FREESWITCH/WebRTC#highlighter_647427
Cheers, David
On Tue, May 29, 2018 at 12:34 PM, Joel Serrano <joel@textplus.com> wrote:
Hi David,
So it all depends.. Those docs are just introductions to get a setup "up and running". For example, in the docs you generate self-signed certificates that (although perfectly valid) can give you issues with browsers because their CA is not trusted, etc. Regarding expiration, it all depends, as this is something you choose.
Going down to your specific problems:
1- ..${prefix}.. is just a variable, that will be replaced with a value, normally /usr/local/freeswitch, but can be anything (depending on where you installed FS). 2- When it comes to the "path" that you specify in the config for the certificates, it can also be anything, the important part is that you make sure that the user you run FS with has access to reading those files. If you don't like using ${prefix} you can directly set /path/to/your/certs, just remember double checking the permissions. 3- When you renew your certificate, you will have to make FS aware of that, I'd have to check but I'm pretty sure that after updating the files a sofia profile rescan should be enough.
Hey David, I did a search in the packages and found gentls_cert is put in /usr/bin by default unless you specified an argument to install FS somewhere else. Unless you have some need to be creating your own self-signed cert it seems like you could use lets encrypt (at least according to the Debian 8 install page) which may simplify some of the key management (creation/renewal) for you. I believe their simple renewal script is called certbot. You just need to wrap certbot in a bash script calling the profile rescan after the key is renewed like Joel Serrano said. Thanks, Branden From: FreeSWITCH-users <freeswitch-users-bounces@lists.freeswitch.org> On Behalf Of David P Sent: Tuesday, May 29, 2018 11:49 AM To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Subject: Re: [Freeswitch-users] Achieving TLS + SRTP for inbound calls Hi Joel, please have a look at my first post yesterday in this thread in which I ask about that doc. In particular, what is {prefix} for a jessie install? And if I follow steps 1-4, how do I renew the cert later? On Tue, 29 May 2018, 11:28 am Joel Serrano, <joel@textplus.com<mailto:joel@textplus.com>> wrote: Hi David, Have a look at: https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS You have information on how to generate the certificates.. On Mon, May 28, 2018 at 9:46 PM, David P <davidswalkabout@gmail.com<mailto:davidswalkabout@gmail.com>> wrote: To be a little more specific, I think you would suggest following https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCe... after installing fs on jessie. However, the section there about "Install Certificates" assumes there is already a cert, key, and chain on disk that can be concatenated into a wss.pem. But it seems to me those files don't exist after installing fs on jessie; in particular, /etc/freeswitch/tls/ is empty. On Mon, May 28, 2018 at 9:00 PM, David P <davidswalkabout@gmail.com<mailto:davidswalkabout@gmail.com>> wrote: Ok, Giovanni. Using your confluence page's search box (not google) for jessie yields one match: https://freeswitch.org/confluence/display/FREESWITCH/Debian+8+Jessie I launched a debian jessie EC2, then followed section "Installing From Debian Packages" at the link above. In particular, I followed the advice in the comment about creating a "freeswitch" folder under /etc before the apt-get to install freeswitch. There were no errors. Now the only thing under /etc/freeswitch/ is an empty tls/ folder. Is this expected? Next, to install a CA cert for use by verto and SIP clients, do I follow steps 1-4 at https://freeswitch.org/confluence/display/FREESWITCH/SIP+TLS ? If so, what is {prefix} for this kind of FS install? On Mon, May 28, 2018 at 8:03 AM, Giovanni Maruzzelli <gmaruzz@gmail.com<mailto:gmaruzz@gmail.com>> wrote: - Trash your aws instance - Start with a new jessie 64 sefver i stance (jessie!!!) - search in freeswitch.org/confluence<http://freeswitch.org/confluence> about jessie - follow the steps to "install freeswit h on jessie" (copy and paste) - profit! Do not try anything advanced until you know the basics. -giovanni _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org<mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org<mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (5)
-
Branden Jordan
-
David P
-
Giovanni Maruzzelli
-
Joel Serrano
-
Michael Jerris