# BigBlueButton v2.6 on Docker（v2.4からのアップデート、IPv6対応）

**URL:** https://forum.ficusonline.com/t/topic/483
**Category:** Server
**Created:** [2023 年 4 月 28 日午前 2:29 UTC](https://forum.ficusonline.com/t/topic/483 "2023-04-28T02:29:31Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![tk-fuse](https://forum.ficusonline.com/user_avatar/forum.ficusonline.com/tk-fuse/32/255_2.png) [@tk-fuse](https://forum.ficusonline.com/u/tk-fuse)
#### Post date: [2023 年 5 月 3 日午前 12:44 UTC](https://forum.ficusonline.com/t/topic/483/3 "2023-05-03T00:44:07Z")

</div>

## Let’t EncryptによるSSL/TLS証明書の利用について

Certbotで取得したLet’s EncryptによるTLS証明書は以下のケースで利用します。

- Coturn：TLS listening ポート443
- Nginx：HTTPS ポート443
- FreeSwitch：SIPS ポート5081
- FreeSwitch：WSS ポート7443

CoturnとNginxについては、Certbotで取得したファイルをそのまま利用できますが、FreeSwitchについては、取得したファイル群から新たなファイルを作成する必要があります。

> [@FreeSWITCH:コマンドラインツールfs\_cliと各種設定のポイント](https://forum.ficusonline.com/t/topic/410/5):
>
> bangbangWebRTC (secure web socket wss settings) edit /usr/local/freeswitch/conf/sip\_profiles/internal.xml # Set these params and save the file: \<param name="tls-cert-dir" value="/usr/local/fr…

> **[Setting up Apache:​ - WebRTC | FreeSWITCH Documentation](https://developer.signalwire.com/freeswitch/FreeSWITCH-Explained/Configuration/WebRTC_3375381/#setting-up-apache)**
>
> WebRTC provides Real-Time Communications directly from better web browsers and devices without requiring plug-ins such as Adobe Flash nor Silverlight. WebRTC always operates in secure mode.FreeSWITCH provides a WebRTC portal to its public conference...

> **[Step 3 - Sofia Profile Configuration​ - SIP TLS | FreeSWITCH Documentation](https://developer.signalwire.com/freeswitch/FreeSWITCH-Explained/Security/SIP-TLS_9634135/#step-3---sofia-profile-configuration)**
>
> FreeSWITCH supports both encrypted signaling known as SIPS which can be SSL or TLS with signed certificates, as well as encrypted audio/media known as SRTP. Typical convention is to have the unencrypted SIP control channel on UDP port 5060 (although...

**`Let's Encrypt`からの取得ファイル**

```auto
# ls /etc/letsencrypt/live/www.example.com
cert.pem chain.pem fullchain.pem privkey.pem

```

**`wss.pem`の作成**

```auto
# cd /etc/letsencrypt/live/www.example.com
# cat cert.pem privkey.pem fullchain.pem > wss.pem

```

**`agent.pem`の作成**

```auto
# cat cert.pem privkey.pem > agent.pem

```

**Note)** Let’s Encryptの認証ファイルから作成した **wss.pem** は、SIPのTLS認証にも利用できますが、別ファイル名で指定する必要があるようです。 **`wss.pem`** からのリンクファイルを **`agent.pem, tls.pem, dtls-srtp.pem`** として作成して下さい。

> **[Import SSL Certificate](https://www.pbxforums.com/threads/import-ssl-certificate.4312/)**
>
> I want to import an SSL certificate instead of using Let's Encrypt but having a hard time finding documentation on steps. I think I can alter the SSL config in sites enabled for the web interface but what about Freeswitch? Any help would be greatly...

* * *

## FreeSwitchセキュアウェブソケットWSS、SIPS対応

下記 **Docker Compose** ファイルの **`FreeSwitch`** サービスの **`volumes:`** セクションに **`wss`** に必要な **TLS/SSL** 証明書ディレクトリを追加

```auto
freeswitch:
      ......
      ......
    volumes:
      - ./conf/sip_profiles:/etc/freeswitch/sip_profiles/external
      - ./conf/dialplan_public:/etc/freeswitch/dialplan/public_docker
      - vol-freeswitch:/var/freeswitch/meetings
      ## added for wss: secure web socket. see the below "nginx" service "volumes"
      - /etc/letsencrypt/live/${DOMAIN}:/etc/freeswitch/tls
      ......
      ......

```

**`mod/freeswitch/conf/sip_profiles/external.xml`**

```auto
.....
.....
    <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) -->
    <param name="tls-cert-dir" value="/etc/freeswitch/tls"/>
.....
.....

```

**`mod/freeswitch/conf/sip_profiles/external-ipv6.xml`**

```auto
.....
.....
    <!-- Location of the agent.pem and cafile.pem ssl certificates (needed for TLS server) -->
    <param name="tls-cert-dir" value="/etc/freeswitch/tls"/>
.....
.....    

```

* * *

**`mod/freeswitch/conf/vars.xml.tmpl`**

```xml
  <!-- external_rtp_ip
       Can be an one of:
           ip address: "12.34.56.78"
           a stun server lookup: "stun:stun.server.com"
           a DNS name: "host:host.server.com"
       where fs.mydomain.com is a DNS A record-useful when fs is on
       a dynamic IP address, and uses a dynamic DNS updater.
       If unspecified, the bind_server_ip value is used.
       Used by: sofia.conf.xml dingaling.conf.xml
  -->
  <X-PRE-PROCESS cmd="set" data="external_rtp_ip={{ .Env.EXTERNAL_IPv4 }}"/>

  <!-- external_sip_ip
      Used as the public IP address for SDP.
       Can be an one of:
           ip address: "12.34.56.78"
           a stun server lookup: "stun:stun.server.com"
           a DNS name: "host:host.server.com"
       where fs.mydomain.com is a DNS A record-useful when fs is on
       a dynamic IP address, and uses a dynamic DNS updater.
       If unspecified, the bind_server_ip value is used.
       Used by: sofia.conf.xml dingaling.conf.xml
  -->
  <X-PRE-PROCESS cmd="set" data="external_sip_ip={{ .Env.EXTERNAL_IPv4 }}"/>
.....
.....
  <X-PRE-PROCESS cmd="set" data="external_ssl_enable=true"/>
.....
.....

```

> **[freeswitch/conf/vanilla/sip\_profiles at master · signalwire/freeswitch](https://github.com/signalwire/freeswitch/tree/master/conf/vanilla/sip_profiles)**
>
> FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a versatile software implementation that runs on any commodity hardware. From...

---

_[View the full topic](https://forum.ficusonline.com/t/topic/483)._