配置Freeswitch（TLS）

1.安装Freeswitch.msi

2.生成CA证书、客户端证书、服务器端证书
生成证书的方法参见《生成CA根证书、公钥、私钥指令（数字证书）》
cat ca.crt ca.key > cafile.pem
cat server.crt server.key > agent.pem
cat client.crt client.key > client.pem

注：
ca.crt 用来验证 client.pem、agent.pem是不是ca.crt签发的
服务器端拿着ca.crt，可以验证客户端的client.pem
客户端拿着ca.crt，可以验证客户端的agent.pem

①进入安装目录：C:\Program Files\FreeSWITCH\conf
②新建文件夹：ssl
③放置上面生成的证书

3.配置双向认证（即服务器开启客户端认证，测试客户端证书）
①C:\Program Files\FreeSWITCH\conf\vars.xml

<X-PRE-PROCESS cmd="set" data="default_password=1234"/> //SIP注册的默认密码，全局

<!-- Internal SIP Profile -->
<X-PRE-PROCESS cmd="set" data="internal_auth_calls=true"/>
<X-PRE-PROCESS cmd="set" data="internal_sip_port=5060"/>
<X-PRE-PROCESS cmd="set" data="internal_tls_port=5061"/>
<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>  //开启SSL
<X-PRE-PROCESS cmd="set" data="internal_ssl_dir=$${conf_dir}/ssl"/>  //SSL证书路径

②C:\Program Files\FreeSWITCH\conf\sip_profiles\internal.xml

<!-- TLS: disabled by default, set to "true" to enable -->
<param name="tls" value="$${internal_ssl_enable}"/>
<!-- Set to true to not bind on the normal sip-port but only on the TLS port -->
<param name="tls-only" value="false"/>
<!-- additional bind parameters for TLS -->
<param name="tls-bind-params" value="transport=tls"/>
<!-- Port to listen on for TLS requests. (5061 will be used if unspecified) -->
<param name="tls-sip-port" value="$${internal_tls_port}"/>
<!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) -->
<param name="tls-cert-dir" value="$${internal_ssl_dir}"/> //SSL证书路径,默认有一个证书，未配置路径
<!-- Optionally set the passphrase password used by openSSL to encrypt/decrypt TLS private key files -->
<param name="tls-passphrase" value=""/>
<!-- Verify the date on TLS certificates -->
<param name="tls-verify-date" value="all"/>//默认为none，不验证客户端证书，设为all表示双向验证
<!-- TLS verify policy, when registering/inviting gateways with other servers (outbound) or handling inbound registration/invite requests how should we verify their certificate -->
<!-- set to 'in' to only verify incoming connections, 'out' to only verify outgoing connections, 'all' to verify all connections, also 'subjects_in', 'subjects_out' and 'subjects_all' for subject validation. Multiple policies can be split with a '|' pipe -->
<param name="tls-verify-policy" value="all"/>
<!-- Certificate max verify depth to use for validating peer TLS certificates when the verify policy is not none -->
<param name="tls-verify-depth" value="2"/>
<!-- If the tls-verify-policy is set to subjects_all or subjects_in this sets which subjects are allowed, multiple subjects can be split with a '|' pipe -->
<param name="tls-verify-in-subjects" value=""/>
<!-- TLS version default: tlsv1,tlsv1.1,tlsv1.2 -->
<param name="tls-version" value="$${sip_tls_version}"/>

<!-- TLS ciphers default: ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH -->
<param name="tls-ciphers" value="$${sip_tls_ciphers}"/>

③分机配置文件目录：C:\Program Files\FreeSWITCH\conf\directory\default
一个分机对应一个xml，一共默认有20个帐号（1000-1019）可以设置简单的password、caller-id等等

4.注册Freeswitch帐号
①安装完成后在安装目录下选择FreeswitchConsole.exe执行文件，以管理员的身份运行，这样会打开命令行的工具并运行，运行时间为30s左右；
最后运行到此图即为安装成功，服务器正在运行

②帐号配置
测试证书，此处需要选择TLS的传输方式

有关FreeSwitch的其他配置操作请看
《FreeSwitch配置和使用手册》