kenmirrors/asterisk
1
0
Fork 0
mirror of https://github.com/asterisk/asterisk.git synced 2025-10-12 15:45:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

dtls: Add support for ephemeral DTLS certificates.

Browse Source 
This mimics the behavior of Chrome and Firefox and creates an ephemeral
X.509 certificate for each DTLS session.

Currently, the only supported key type is ECDSA because of its faster
generation time, but other key types can be added in the future as
necessary.

ASTERISK-27395

Change-Id: I5122e5f4b83c6320cc17407a187fcf491daf30b4
This commit is contained in:
Sean Bright
2017-09-29 14:50:17 +00:00
committed by Joshua Colp
parent be5b7b2076
commit 04d3785a79
10 changed files with 409 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
res/res_pjsip.c
View File

@@ -772,6 +772,18 @@
If this is not set or the value provided is 0 rekeying will be disabled.
</para></description>
</configOption>
<configOption name="dtls_auto_generate_cert" default="no">
<synopsis>Whether or not to automatically generate an ephemeral X.509 certificate</synopsis>
<description>
<para>
If enabled, Asterisk will generate an X.509 certificate for each DTLS session.
This option only applies if <replaceable>media_encryption</replaceable> is set
to <literal>dtls</literal>. This option will be automatically enabled if
<literal>webrtc</literal> is enabled and <literal>dtls_cert_file</literal> is
not specified.
</para>
</description>
</configOption>
<configOption name="dtls_cert_file">
<synopsis>Path to certificate file to present to peer</synopsis>
<description><para>
@@ -1028,6 +1040,7 @@
use_received_transport. The following configuration settings also get defaulted
as follows:</para>
<para>media_encryption=dtls</para>
<para>dtls_auto_generate_cert=yes (if dtls_cert_file is not set)</para>
<para>dtls_verify=fingerprint</para>
<para>dtls_setup=actpass</para>
</description>