XGW.Certs (xgw v0.1.0)

Copy Markdown View Source

Creates and fingerprints the TLS certificate used for DTLS.

Why certificates matter here

Before media is encrypted with SRTP, the two peers run a DTLS handshake (TLS over UDP). Each side presents a certificate. In WebRTC the certificate is usually self-signed; trust comes from comparing its SHA-256 fingerprint to the value advertised in SDP (a=fingerprint:), not from a public CA.

This module:

  • Generates a self-signed cert/key pair with openssl when missing (ensure!/1).
  • Computes the colon-separated uppercase hex fingerprint browsers expect.
  • Checks that a remote SDP fingerprint matches a DER certificate.

RFCs

  • RFC 8122 -- SDP a=fingerprint attribute (certificate digests)
  • RFC 9147 / RFC 6347 -- DTLS (certificate presented during handshake)

Summary

Functions

ensure!(dir)

Returns {certfile, keyfile} paths, generating a self-signed pair when missing.

fingerprint(certfile)

SHA-256 fingerprint as colon-separated uppercase hex for SDP.

fingerprint_der(der)

SHA-256 fingerprint as colon-separated uppercase hex from DER bytes.

fingerprint_matches?(map, der)

Returns true when der matches an SDP %Fingerprint{} (sha-256 only for v1).

Functions

ensure!(dir)

@spec ensure!(Path.t()) :: {Path.t(), Path.t()}

Returns {certfile, keyfile} paths, generating a self-signed pair when missing.

fingerprint(certfile)

@spec fingerprint(Path.t()) :: String.t()

SHA-256 fingerprint as colon-separated uppercase hex for SDP.

fingerprint_der(der)

@spec fingerprint_der(binary()) :: String.t()

SHA-256 fingerprint as colon-separated uppercase hex from DER bytes.

Examples

iex> der = :crypto.hash(:sha256, "test")
iex> fp = XGW.Certs.fingerprint_der(der)
iex> String.match?(fp, ~r/^[0-9A-F]{2}(:[0-9A-F]{2}){31}$/)
true

fingerprint_matches?(map, der)

@spec fingerprint_matches?(XMediaLib.SDP.Fingerprint.t(), binary()) :: boolean()

Returns true when der matches an SDP %Fingerprint{} (sha-256 only for v1).

Examples

iex> der = "cert-bytes"
iex> fp = XGW.Certs.fingerprint_der(der)
iex> XGW.Certs.fingerprint_matches?(%{algorithm: "sha-256", value: fp}, der)
true

iex> XGW.Certs.fingerprint_matches?(%{algorithm: "sha-1", value: "x"}, <<>>)
false