freeswitch使用自签证书,配置WSS

Freeswitch使用自签证书

1. 使用SSL-TOOLS生成自签证书

(1) 下载ssl.ca-0.1.tar.gz

[root@localhost ~]# wget http://files.freeswitch.org/downloads/ssl.ca-0.1.tar.gz

(2) 解压ssl.ca-0.1.tar.gz

tar zxfv ssl.ca-0.1.tar.gz

(3) 执行以下命令

[root@localhost software]# cd ssl.ca-0.1/
[root@localhost ssl.ca-0.1]# perl -i -pe 's/md5/sha1/g' *.sh
[root@localhost ssl.ca-0.1]# perl -i -pe 's/2048/2048/g' *.sh

(4) 生成根证书

[root@localhost ssl.ca-0.1]# ./new-root-ca.sh
No Root CA key round. Generating one
Generating RSA private key, 1024 bit long modulus
.....................++++++
...............................................................++++++
e is 65537 (0x10001)
Enter pass phrase for ca.key:  根证书密码
Verifying - Enter pass phrase for ca.key:

Self-sign the root CA...
Enter pass phrase for ca.key:  根证书密码
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [MY]:CN  国籍
State or Province Name (full name) [Perak]:JIANGSU 省份
Locality Name (eg, city) [Sitiawan]:NANJING  市
Organization Name (eg, company) [My Directory Sdn Bhd]:HY 公司名称
Organizational Unit Name (eg, section) [Certification Services Division]:HY 组织名称
Common Name (eg, MD Root CA) []:HY 常用名
Email Address []:HY@163.com  邮箱地址
[root@localhost ssl.ca-0.1]#

执行完毕后,会在当前目录生成ca.key和ca.crt两个文件

(5) 为我们的服务器生成一个证书

[root@localhost ssl.ca-0.1]# ./new-server-cert.sh  server 
Fill in certificate data
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [MY]:CN
State or Province Name (full name) [Perak]:JIANGSU
Locality Name (eg, city) [Sitiawan]:NANJING
Organization Name (eg, company) [My Directory Sdn Bhd]:HY
Organizational Unit Name (eg, section) [Secure Web Server]:HY
Common Name (eg, www.domain.com) []:localhost 此处可更换为域名
Email Address []:HY@163.com

You may now run ./sign-server-cert.sh to get it signed

执行完毕后,生成了server.csr和server.key这两个文件

(6) 签署证书使证书生效

[root@localhost ssl.ca-0.1]# ./sign-server-cert.sh server
CA signing: server.csr -> server.crt:
Using configuration from ca.config
Enter pass phrase for ./ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'JIANGSU'
localityName          :PRINTABLE:'NANJING'
organizationName      :PRINTABLE:'HY'
organizationalUnitName:PRINTABLE:'HY'
commonName            :PRINTABLE:'localhost'
emailAddress          :IA5STRING:'HY@163.com'
Certificate is to be certified until Nov  9 06:26:54 2019 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
CA verifying: server.crt <-> CA cert
server.crt: OK

执行完毕后,生成了server.crt文件

以上操作执行完毕后,你会在当前目录看到如下三个文件

    [root@254 ssl.ca-0.1]# ll
 	总用量 96
	-rw-r--r-- 1 root root   932 6月  25 09:44 ca.crt
	drwxr-xr-x 2 root root    20 6月  25 09:45 ca.db.certs
	-rw-r--r-- 1 root root    97 6月  25 09:45 ca.db.index
	-rw-r--r-- 1 root root    21 6月  25 09:45 ca.db.index.attr
	-rw-r--r-- 1 root root     3 6月  25 09:45 ca.db.serial
	-rw-r--r-- 1 root root   963 6月  25 09:43 ca.key
	-rw-r--r-- 1  500  500 17992 4月  24 2000 COPYING
	-rwxr-xr-x 1  500  500  1460 6月  25 09:43 new-root-ca.sh
	-rwxr-xr-x 1  500  500  1539 6月  25 09:43 new-server-cert.sh
	-rwxr-xr-x 1  500  500  1049 6月  25 09:43 new-user-cert.sh
	-rwxr-xr-x 1  500  500   984 6月  25 09:43 p12.sh
	-rw-r--r-- 1  500  500  1024 4月  23 2000 random-bits
	-rw-r--r-- 1  500  500 11503 4月  24 2000 README
	-rw-r--r-- 1 root root  3092 6月  25 09:45 server.crt   ---------->
	-rw-r--r-- 1 root root   737 6月  25 09:45 server.csr   ----------> 后续操作主要使用到这三个文件
	-rw-r--r-- 1 root root   891 6月  25 09:44 server.key  ---------->
	-rwxr-xr-x 1  500  500  2080 6月  25 09:43 sign-server-cert.sh
	-rwxr-xr-x 1  500  500  1916 6月  25 09:43 sign-user-cert.sh
	-rw-r--r-- 1  500  500    50 4月  24 2000 VERSION

2. 替换freeswitch的证书(wss.pem)

开始替换证书 [请注意备份freeswitch的证书] 以下是笔者wss.pem所在目录,请根据自身fs所装目录确定证书位置,也可以使用find命令查找

	[root@izwz9ixh3287isfn0r8cm6z ~]# find / -name wss.pem
	/usr/local/freeswitch/certs/wss.pem  ----->wss.pem所在位置

	[root@localhost ssl.ca-0.1]# cd /usr/local/server/software/ssl.ca-0.1
	[root@localhost ssl.ca-0.1]# cat server.crt server.key > /usr/local/freeswitch/certs/wss.pem
	[root@localhost ssl.ca-0.1]# cat /usr/local/freeswitch/certs/wss.pem
	Certificate:
	    Data:
	        Version: 3 (0x2)
	        Serial Number: 1 (0x1)
	    Signature Algorithm: sha1WithRSAEncryption
	        Issuer: C=CN, ST=JIANGSU, L=NANJING, O=HY, OU=HY, CN=HY/emailAddress=HY@163,\x08\x1B[D\x1B[3~
	        Validity
	            Not Before: Nov  9 06:26:54 2018 GMT
	            Not After : Nov  9 06:26:54 2019 GMT
	        Subject: C=CN, ST=JIANGSU, L=NANJING, O=HY, OU=HY, CN=localhost/emailAddress=HY@163.com
	        Subject Public Key Info:
	            Public Key Algorithm: rsaEncryption
	                Public-Key: (1024 bit)
	                Modulus:
	                    00:ca:87:6e:7a:b5:0b:40:b4:a5:5f:4c:03:7a:f9:
	                    f9:2e:d9:a8:bd:e2:d8:2d:45:dd:a1:58:d8:d4:98:
	                    31:e1:aa:bd:43:8d:77:cc:c8:f9:62:56:62:ac:0c:
	                    1c:4a:58:b3:46:58:5c:b6:27:a4:17:02:7a:0a:77:
	                    06:ba:a5:e9:fb:60:eb:16:45:45:e4:8c:13:ab:48:
	                    6f:e4:35:b0:2c:b3:46:91:43:8f:93:f9:9a:ec:bc:
	                    b5:46:8f:d2:bd:26:47:07:e1:f4:40:27:76:a1:e3:
	                    cf:ce:75:05:1f:d2:6a:37:fc:39:77:74:97:1e:e9:
	                    72:2c:5e:91:3c:9e:74:2d:91
	                Exponent: 65537 (0x10001)
	        X509v3 extensions:
	            X509v3 Authority Key Identifier: 
	                keyid:DD:66:29:32:E6:2E:98:ED:9A:39:89:C2:EF:07:5C:E3:6E:F9:63:B5
	
	            X509v3 Extended Key Usage: 
	                TLS Web Server Authentication, TLS Web Client Authentication, Microsoft Server Gated Crypto, Netscape Server Gated Crypto
	            X509v3 Basic Constraints: critical
	                CA:FALSE
	    Signature Algorithm: sha1WithRSAEncryption
	         2a:a5:a6:35:68:a3:b0:e4:3a:77:88:28:e6:39:ca:ba:2e:95:
	         28:b3:7d:b3:53:35:1d:f3:4a:1a:02:f1:c4:03:52:c3:02:e6:
	         5d:d5:29:08:17:41:f0:83:e4:c3:f8:a7:58:88:20:0c:93:ff:
	         78:b4:0b:e6:31:53:13:cb:f3:6c:3c:1b:ea:35:67:1e:1f:89:
	         be:f8:10:cc:ec:0b:a7:75:01:89:72:a8:51:95:03:34:3f:17:
	         7a:f1:fd:54:8d:55:8f:10:91:69:a1:55:c2:c8:76:48:a1:f2:
	         d9:dc:47:47:a7:9e:3a:00:a4:c6:ad:44:67:59:96:21:38:0d:
	         dd:0a
	-----BEGIN CERTIFICATE-----
	MIICzzCCAjigAwIBAgIBATANBgkqhkiG9w0BAQUFADB4MQswCQYDVQQGEwJDTjEQ
	MA4GA1UECBMHSklBTkdTVTEQMA4GA1UEBxMHTkFOSklORzELMAkGA1UEChMCSFkx
	CzAJBgNVBAsTAkhZMQswCQYDVQQDEwJIWTEeMBwGCSqGSIb3DQEJARYPSFlAMTYz
	LAgbW0QbWzN+MB4XDTE4MTEwOTA2MjY1NFoXDTE5MTEwOTA2MjY1NFowejELMAkG
	A1UEBhMCQ04xEDAOBgNVBAgTB0pJQU5HU1UxEDAOBgNVBAcTB05BTkpJTkcxCzAJ
	BgNVBAoTAkhZMQswCQYDVQQLEwJIWTESMBAGA1UEAxMJbG9jYWxob3N0MRkwFwYJ
	KoZIhvcNAQkBFgpIWUAxNjMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
	gQDKh256tQtAtKVfTAN6+fku2ai94tgtRd2hWNjUmDHhqr1DjXfMyPliVmKsDBxK
	WLNGWFy2J6QXAnoKdwa6pen7YOsWRUXkjBOrSG/kNbAss0aRQ4+T+ZrsvLVGj9K9
	JkcH4fRAJ3ah48/OdQUf0mo3/Dl3dJce6XIsXpE8nnQtkQIDAQABo2cwZTAfBgNV
	HSMEGDAWgBTdZiky5i6Y7Zo5icLvB1zjbvljtTA0BgNVHSUELTArBggrBgEFBQcD
	AQYIKwYBBQUHAwIGCisGAQQBgjcKAwMGCWCGSAGG+EIEATAMBgNVHRMBAf8EAjAA
	MA0GCSqGSIb3DQEBBQUAA4GBACqlpjVoo7DkOneIKOY5yroulSizfbNTNR3zShoC
	8cQDUsMC5l3VKQgXQfCD5MP4p1iIIAyT/3i0C+YxUxPL82w8G+o1Zx4fib74EMzs
	C6d1AYlyqFGVAzQ/F3rx/VSNVY8QkWmhVcLIdkih8tncR0ennjoApMatRGdZliE4
	Dd0K
	-----END CERTIFICATE-----
	-----BEGIN RSA PRIVATE KEY-----
	MIICXQIBAAKBgQDKh256tQtAtKVfTAN6+fku2ai94tgtRd2hWNjUmDHhqr1DjXfM
	yPliVmKsDBxKWLNGWFy2J6QXAnoKdwa6pen7YOsWRUXkjBOrSG/kNbAss0aRQ4+T
	+ZrsvLVGj9K9JkcH4fRAJ3ah48/OdQUf0mo3/Dl3dJce6XIsXpE8nnQtkQIDAQAB
	AoGAbTYSsUCnTMEc3AKVbd8WK9lbUOneQKuIE9VhN2LKozH61U6X52oIcKq8kqIF
	L2IdajWD6QX/ShkfzjzY+BU30kyiVhP+iJctfpWr7wlEp8GchteX2RumBRxAsBg2
	rw6cXdQ9PHo6ykf0nQpwVeiiq2x4ccs4AEWqWkkYVtc9cAECQQDjv0x8USMOr83f
	rD8Egx/c3Os8fDjn7Bq+YKRxuU/qdgqsSAISIMiEWh8h3l+eHDJDmZAF5u2D9FC9
	mYT8PYtRAkEA46dDSsM7b5yOt6WQO+YyfU968KEDP1rX41davnWh7lbwvuiJIlnJ
	PhZ2rysJY8qs2+r+GAJQTSl7LDwSRcduQQJBANRTJZCE6EUp+6p64ClpwcvcHmc+
	fKMjyG8SlFz94hZ5REwHuf6Cl85kYr/lnIlASlAhm1cVSvwJSzjoJkYvbnECQQDD
	Dnio4VjWy+S408IeoKGYHvauoLcgnJyn7RwSXsYNai7C1IlThmzYpvSwKAbWmzy6
	/cETH0BgrO8duqbJZRRBAkAOSOOGHC137WzOwx20iTpqciX8Ir2mOvGMWW8Wd/9p
	yglapIxq3Hd0cGdIxbqHZpSmN7mkUbgfgvYVlH9fW8lz
	-----END RSA PRIVATE KEY-----

(2) 修改freeswitch相关配置

• 修改internal.xml

	[root@254 ssl.ca-0.1]# vim /usr/local/freeswitch/conf/sip_profiles/internal.xml
	设置wss-binding,默认为7443,可修改
	<param name="wss-binding" value=":7443"/>
	
	执行此命令可以看到wss所绑定的端口
	[root@254 ssl.ca-0.1]# fs_cli -x 'sofia status profile internal' | grep WSS-BIND-URL
    WSS-BIND-URL     	sips:mod_sofia@192.168.0.254:7443;transport=wss

• 修改vars.xml

	[root@254 ssl.ca-0.1]# vim /usr/local/freeswitch/conf/vars.xml
	设置以下参数
	<X-PRE-PROCESS cmd="set" data="internal_ssl_enable=true"/>
    <X-PRE-PROCESS cmd="set" data="external_ssl_enable=true"/>

修改完成后,请重启freeswitch,然后执行以下命令

	[root@localhost ssl.ca-0.1]# fs_cli
	...	
	...

	+OK log level  [7]
	freeswitch@localhost.localdomain> reloadxml

---

WEB项目使用自签证书

---

此处我们需要使用到之前生成的三个文件,server.crt,server.csr,server.key

1. 将自签证书转为tomcat.p12

	[root@localhost ssl.ca-0.1]# openssl pkcs12 -export -in /usr/local/server/software/ssl.ca-0.1/server.crt -inkey /usr/local/server/software/ssl.ca-0.1/server.key -out /usr/local/server/software/ssl.ca-0.1/tomcat.p12

2. 在springboot项目中引用keystore,使用HTTPS

	# 证书存放路径 根据实际情况放置(绝对路径) 此文件也可以放置在项目中,具体实现可以百度
	server.ssl.key-store=/usr/local/server/tomcat.p12
	#密钥库密码
	server.ssl.key-store-password=111111
	server.ssl.keyStoreType=PKCS12

---

本节主要讲解了fs如何配置https,使用自签证书,下一节会讲解如何结合SIP.JS实现软电话功能

---

##参考资料: https://blog.csdn.net/u013944791/article/details/73551253
##参考资料: https://blog.csdn.net/medivhq/article/details/51188242
##参考资料: https://freeswitch.org/confluence/display/FREESWITCH/WebRTC#WebRTC-InstallCertificates