Can't verify TLS certificate (Android)

[Paride Legovini]

Hello,

I'm trying to use a "turns:" coturn relay on an Android app using Google's WebRTC library [1] (version M57).

If I use a regular "turn:" URI it works fine, and so it does if I use "turns:" but tell the library not to verify the TLS certificate, like this:

new PeerConnection.IceServer("turns:turn.example.com:8443?transport=tcp", "user", "pass", PeerConnection.TlsCertPolicy.TLS_CERT_POLICY_INSECURE_NO_CHECK);

When I switch to TLS_CERT_POLICY_SECURE (the default, which check the certificate validity), without touching anything else, the connection to the TURN server fails.

Now, the TLS certificate I use is a valid letsencrypt certificate that is recognized by the device.

The TURN server (coturn-4.5.0.6) also works as an https server, and I can connect to:

https://turn.example.com:8443/

using a WebView browser on the same device and the certificate is recognized.

If I use Trickle ICE [2] I can connect to the "turns:" server and I get no warning/error on the certificate.

The problem seems to exist only on Android, and it's happening on both an emulated and physical device running stock Android 7.1.1

Is there anything obvious I should check?

Did anybody succeed in using coturn as a TLS TURN relay on Android?

Thank you,

Paride

[1] https://chromium.googlesource.com/external/webrtc

[2] https://webrtc.github.io/samples/src/content/peerconnection/trickle-ice/

[Mustafa Darwich]

I've done the same, however I can not see any ssl/tls traffic using the tcpdump on the server. Did you manage to get any info ?!