-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Description
Is your feature request related to a problem? Please describe.
It seems that currently freeSWITCH does not allow DTLS certificates with keys smaller than 4096 bits:
freeswitch/src/switch_core_cert.c
Lines 374 to 377 in 418edb8
| if (bits < 4096) { | |
| switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_WARNING, "%s cryptographic length is too short (%d), it will be regenerated\n", pem, bits); | |
| goto rename_pem; | |
| } |
which essentially disallows much smaller yet secure EC-based certificates.
I specifically have an issue where I am trying to use Python's aiortc module which apparently can't parse certificates that large correctly: aiortc/aiortc#828 and in general the current logic appears to be unnecessarily restrictive in 2025.
Describe the solution you'd like
Either lower the size limit or possibly better leave it only for RSA certificates
Describe alternatives you've considered
While I am running freeSWITCH in docker I can generate EC certificate after startup in a custom entrypoint.sh, but this is not viable long term solution
Package version or git hash
- Running latest docker image - v1.10.12