How to enable media encryption on WSS?

[SergSV12]

Help setting up WSS in baresip+ with media encryption. How to enable SRTP protocol?
What I do: is create an account, add “sip:siptest.test.net:8089;transport=wss” to “Outgoing proxies”, select “SRTP-MANDF” for media encryption.
Registration is successful. The call to baresip+ is working. The video conversation is established. But baresip+ sends unencrypted media data. How to fix it?

[juha-h]

Please see the Wiki about Debugging info. WebRTC uses DTLS-SRTPF for encryption.

[SergSV12]

I see an error in the PBX log:
"video Handshake failure 1. This may happen when you use legacy DTLS v1.0 (legacyDTLS channel var is set) but endpoint requires DTLS v1.2."

How to disable DTLS v1.0 and force enable DTLS v1.2?

[juha-h]

Looks to me that you need to fix the issue in your PBX, i.e., make it support DTLS v1.2.

[SergSV12]

Some calls work fine, but some fail. I compared the packages in Wireshark. The packages from PBX are no different. Baresip's reaction varies.
In some cases it sends an "Alert".
What could be the reason? How to fix this problem?

Is working:

Is don't working:

I am attaching network dumps:
pcap.zip

Logcat:

[juha-h]

I'm not a crypto expert. Try asking some crypto forum or search from the net what could cause such TLS error messages. baresip is using OpenSSL version 3.1 from March 14, 2023.

[juha-h]

I made several tests between baresip+ and LInphone using DTLS-SRTPF media encryption and in all tests DTLSv1.2 negotiation worked without errors. So I suspect that there is something wrong with your PBX. In any case, there is nothing I can do to help.

[SergSV12]

What PBX did you use? What is the version of OpenSSL on the PBX?