{"action":"created","issue":{"url":"https://api.github.com/repos/jitsi/libjitsi/issues/134","repository_url":"https://api.github.com/repos/jitsi/libjitsi","labels_url":"https://api.github.com/repos/jitsi/libjitsi/issues/134/labels{/name}","comments_url":"https://api.github.com/repos/jitsi/libjitsi/issues/134/comments","events_url":"https://api.github.com/repos/jitsi/libjitsi/issues/134/events","html_url":"https://github.com/jitsi/libjitsi/pull/134","id":147265745,"number":134,"title":"Configurable DTLS certificate generation parameters.","user":{"login":"bickelj","id":8806433,"avatar_url":"https://avatars.githubusercontent.com/u/8806433?v=3","gravatar_id":"","url":"https://api.github.com/users/bickelj","html_url":"https://github.com/bickelj","followers_url":"https://api.github.com/users/bickelj/followers","following_url":"https://api.github.com/users/bickelj/following{/other_user}","gists_url":"https://api.github.com/users/bickelj/gists{/gist_id}","starred_url":"https://api.github.com/users/bickelj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bickelj/subscriptions","organizations_url":"https://api.github.com/users/bickelj/orgs","repos_url":"https://api.github.com/users/bickelj/repos","events_url":"https://api.github.com/users/bickelj/events{/privacy}","received_events_url":"https://api.github.com/users/bickelj/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-04-10T20:45:32Z","updated_at":"2016-04-10T22:12:53Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/jitsi/libjitsi/pulls/134","html_url":"https://github.com/jitsi/libjitsi/pull/134","diff_url":"https://github.com/jitsi/libjitsi/pull/134.diff","patch_url":"https://github.com/jitsi/libjitsi/pull/134.patch"},"body":"This pull request is a replacement of https://github.com/jitsi/libjitsi/pull/67 which is now obsolete.\r\n\r\nHere is a sample of property settings made available and being set:\r\norg.jitsi.impl.neomedia.transform.dtls.RSA_KEY_SIZE_CERTAINTY=80\r\norg.jitsi.impl.neomedia.transform.dtls.RSA_KEY_SIZE=2048\r\norg.jitsi.impl.neomedia.transform.dtls.CERT_CACHE_EXPIRE_TIME=60000\r\norg.jitsi.impl.neomedia.transform.dtls.CERT_VALIDITY_TIME=43200000\r\n\r\nThe jitsi-meet server administrator can set the number of key bits (...RSA_KEY_SIZE), set the certificate cache expire time (...CERT_CACHE_EXPIRE_TIME=0 for the \"old\" way should mean new certificate on every connection), and how long the certificate is valid for after the time of generation (...CERT_VALIDITY_TIME is above set to 12 hours). Times are in milliseconds.\r\n\r\nDefaults remain the same as in master branch.\r\n\r\n@ibauersachs and @champtar and @lyubomir please give your feedback on what can be improved in this pull request.\r\n\r\nI have tested the above values using a properties file only and verified via wireshark to my server. I have not yet tried cache expiry of 0 yet, though I am pretty confident that will work too.\r\n\r\nThank you for considering this one, and you should already have a CLA on file.\r\n\r\nOne more note: had to add getLong to ConfigUtils in order to call it. That's why it's in here."},"comment":{"url":"https://api.github.com/repos/jitsi/libjitsi/issues/comments/208082678","html_url":"https://github.com/jitsi/libjitsi/pull/134#issuecomment-208082678","issue_url":"https://api.github.com/repos/jitsi/libjitsi/issues/134","id":208082678,"user":{"login":"champtar","id":3536755,"avatar_url":"https://avatars.githubusercontent.com/u/3536755?v=3","gravatar_id":"","url":"https://api.github.com/users/champtar","html_url":"https://github.com/champtar","followers_url":"https://api.github.com/users/champtar/followers","following_url":"https://api.github.com/users/champtar/following{/other_user}","gists_url":"https://api.github.com/users/champtar/gists{/gist_id}","starred_url":"https://api.github.com/users/champtar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/champtar/subscriptions","organizations_url":"https://api.github.com/users/champtar/orgs","repos_url":"https://api.github.com/users/champtar/repos","events_url":"https://api.github.com/users/champtar/events{/privacy}","received_events_url":"https://api.github.com/users/champtar/received_events","type":"User","site_admin":false},"created_at":"2016-04-10T22:12:53Z","updated_at":"2016-04-10T22:12:53Z","body":"I prefer simple config that always work, so having only one option help here.\r\n\r\nGenerating RSA key too often is useless as we now enforce PFS since #110.\r\nOn a webserver you regenerate your cert (including key) every month or less and nobody think it's insecure (for letsencrypt it's 90 days).\r\nChrome cache his cert for 30 days.\r\n\r\nMaybe cert/cache validity should be in days and not in seconds, with a minimum of 1."}}