Skip to content

Allow EC DTLS certificates #2958

@vykintazo

Description

@vykintazo

Is your feature request related to a problem? Please describe.
It seems that currently freeSWITCH does not allow DTLS certificates with keys smaller than 4096 bits:

if (bits < 4096) {
switch_log_printf(SWITCH_CHANNEL_LOG, SWITCH_LOG_WARNING, "%s cryptographic length is too short (%d), it will be regenerated\n", pem, bits);
goto rename_pem;
}

which essentially disallows much smaller yet secure EC-based certificates.

I specifically have an issue where I am trying to use Python's aiortc module which apparently can't parse certificates that large correctly: aiortc/aiortc#828 and in general the current logic appears to be unnecessarily restrictive in 2025.

Describe the solution you'd like
Either lower the size limit or possibly better leave it only for RSA certificates

Describe alternatives you've considered
While I am running freeSWITCH in docker I can generate EC certificate after startup in a custom entrypoint.sh, but this is not viable long term solution

Package version or git hash

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions