[asterisk-dev] Asterisk 11; WEBRTC firefox nightly build fingeprint sha-256
mjordan at digium.com
Fri Feb 22 15:09:10 CST 2013
On 02/22/2013 10:40 AM, Mitja Kaučič wrote:
> Hello Joshua and Matthew.
> I would be happy to contribute with a patch.
> I just need folowing info:
> 1. With witch client can i test the current implementation of DTLS-SRTP on asterisk?
They're rather hard to find.
When Josh wrote DTLS-SRTP support for Asterisk, we did a fairly
exhaustive search looking for clients that (a) supported DTLS-SRTP and
(b) could be pointed at Asterisk. At the time, no clients met both
criteria. Those that did support DTLS-SRTP were working hard on creating
closed networks that did not allow another B2BUA to participate.
We tested it by pointing two Asterisk instances at each other and
running Wireshark. And starting at a lot of pcaps.
That situation may have changed.
> 2. To configure DTLS-SRTP properly is it enough to just set dtlsenable=yes do i need dtlsSverify and to set dtls certificats for a basic functionality?
You need a bit more than that. You'll need:
1) The correct version of OpenSSL that supports DTLS installed and
Asterisk built using it
2) CA and cert files generated that will be used by the RTP engine
3) Properly configured endpoints. For a test run of Asterisk <->
Asterisk, the configuration of one instance of Asterisk looked something
directmedia = no
disallow = all
allow = g722
allow = gsm
allow = ulaw
encryption = yes
dtlsenable = yes
dtlsverify = yes
dtlsrekey = 60
dtlscafile = /etc/asterisk/ca.crt
dtlscertfile = /etc/asterisk/asterisk01.pem
dtlssetup = actpass
type = peer
secret = asterisk-01
host = x.x.x.x
context = from-asterisk-01
insecure = invite
Digium, Inc. | Engineering Manager
445 Jan Davis Drive NW - Huntsville, AL 35806 - USA
Check us out at: http://digium.com & http://asterisk.org
More information about the asterisk-dev