Once there is a valid candidate pair (both peers can connect and exchange data between them), it's time to make the connection secure. DTLS is a cryptographic protocol that encrypts the data to avoid inspection or modification of the content of the data exchanged.
DTLS requires the openSSL libraries (from openSSL 1.1+)
The configuration of the DTLS can be found in the RTCOptions.DTLSOptions property of the TsgcRTCPeerConnection. To enable DTLS, set the property RTCOptions.DTLS to True. Find below the main properties:
RootCertFile: path to the trust store used to verify the other end, normally a file holding the certificate authority. This is the same meaning the property has on the TLS and QUIC transports. It is not the certificate of this endpoint, and a configuration that sets RootCertFile and KeyFile while leaving CertFile empty raises an error when the connection starts.
CertFile: path to the certificate file of this endpoint. The file can hold the certificate together with its intermediates, so a chain file works.
KeyFile: path to certificate key file.
VerifyCertificate: if the certificate chain of the other end must be verified, enable this property. WebRTC authenticates the other end by the fingerprint carried in the SDP and not by a certificate chain, so leaving this property disabled is the normal WebRTC configuration, and it is unaffected by the chain verification now enforced on the DTLS transports.
VerifyDepth: is an Integer property that represents the maximum number of links permitted when verification is performed, that is, the maximum chain depth allowed when the certificate of the other end is verified.
OpenSSL_Options: configuration of the openSSL libraries.
APIVersion: allows defining which OpenSSL API will be used. only openSSL API 1.1+ supports DTLS.
oslAPI_1_1: uses API 1.1 OpenSSL, requires our custom Indy library and allows using OpenSSL 1.1.1 libraries (with TLS 1.3 support).
oslAPI_3_0: uses API 3.0 OpenSSL, requires our custom Indy library and allows using OpenSSL 3.0.0 libraries (with TLS 1.3 support).
LibPath: here you can configure where are located the openSSL libraries
oslpNone: this is the default, the openSSL libraries should be in the same folder where is the binary or in a known path.
oslpDefaultFolder: sets automatically the openSSL path where the libraries should be located for all IDE personalities.
oslpCustomFolder: if this is the option selected, define the full path in the property LibPathCustom.
LibPathCustom: when LibPath = oslpCustomFolder define here the full path where are located the openSSL libraries.
UnixSymLinks: enable or disable the loading of SymLinks under Unix systems (by default is enabled, except under OSX64):
oslsSymLinksDefault: by default are enabled except under OSX64 (after MacOS Monterey fails trying to load the library without version.).
oslsSymLinksLoadFirst: Load SymLinks and do before trying to load the version libraries.
oslsSymLinksLoad: Load SymLinks after trying to load the version libraries.
oslsSymLinksDontLoad: don't load the SymLinks.