Server-Specific Configuration

Set basic server settings on the LiveSwitch Console, but some server-specific settings are set in a configuration JSON file.

Each service has a configuration file in its install location:

  • Gateway: FM.LiveSwitch.Gateway.Service.config.json
  • Media Server: FM.LiveSwitch.MediaServer.Service.config.json
  • SIP Connector: FM.LiveSwitch.Connector.Sip.Service.config.json
  • Recording Monitor: FM.LiveSwitch.Recording.Monitor.Service.config.json
  • Recording Mover: FM.LiveSwitch.Recording.Mover.Service.config.json
  • Recording Muxer: FM.LiveSwitch.Recording.Muxer.Service.config.json

These settings are available in every service's configuration JSON file:

Connection Strings

The ConnectionStrings section contains database connection strings to your PostgreSQL and Redis instances. This field is mandatory and all your LiveSwitch services must connect to the same database instances.

"ConnectionStrings": {
    "Default": "postgresql://<postgresql_connection_string>",
    "Cache": "redis://<redis_connecting_string>",
    "RecordingStorage": "postgres://<postgresql_connection_string>",
    "RecordingQueue": "amqp://<rabbitmq_connecting_string>"
}

Each connection string has its own format dependent on its system:

If SSL is required for your PostgreSQL server, you must provide the Trusted Certificate SHA-1 Fingerprint in the configuration string. TrustedServerCertificateSha1Fingerprints applies only to PostgreSQL. For Redis, see Redis TLS and Client Certificates.

"ConnectionStrings": {
    "Default": "postgres://postgres-server-with-ssl-enabled",
    "Cache": "redis://<redis_connecting_string>",
    "RecordingStorage": "postgres://<postgresql_connection_string>",
    "RecordingQueue": "amqp://<rabbitmq_connecting_string>"
},
"TrustedServerCertificateSha1Fingerprints": [ "trusted_sha1_fingerprint" ]

For example:

"ConnectionStrings": {
    "Default": "postgresql://user:password@10.37.129.2:25061/postgres_server?sslmode=require&Server_Compatibility_Mode=Redshift",
    "Cache": "redis://lxjis.redis.cache.windows.net:6380,password=2KfYkEQOCYH8sdfdsfdsfdsEdMV18nSvtE4FrMqnncAFZNsRc=,ssl=True,abortConnect=False",
    "RecordingStorage": "postgres://user:password@10.37.129.2:5432/recording",
    "RecordingQueue": "amqp://user:password@10.37.129.2:5672"
},
"TrustedServerCertificateSha1Fingerprints": [ "trusted_sha1_fingerprint" ]

To generate the fingerprint, download the trusted certificate file from the server and run this command:

openssl x509 -in ca-certificate.crt -outform DER | sha1sum
Note

This command requires that openssl and sha1sum are installed.

Redis TLS and Client Certificates

To connect to Redis over TLS, add ssl=true to the Cache connection string. LiveSwitch validates the Redis server certificate against the operating system's trusted root certificates, so TrustedServerCertificateSha1Fingerprints doesn't apply to Redis. If a private certificate authority (CA) issued your Redis server certificate, add its root certificate to the trust store of each server or container image that runs LiveSwitch services.

Note

If your CA doesn't publish a certificate revocation list (CRL) or an OCSP endpoint, the revocation check fails with RevocationStatusUnknown. To turn off the check, add checkCertificateRevocation=false to the Cache connection string.

Client Certificates

If your Redis server requires clients to present a certificate (mutual TLS), add a CacheClientCertificate section to the configuration file of each service. Client certificates are supported in LiveSwitch Server 1.27.1 and later.

"ConnectionStrings": {
    "Cache": "redis.example.com:6380,ssl=true"
},
"CacheClientCertificate": {
    "CertificatePath": "/etc/liveswitch/redis-tls/tls.crt",
    "KeyPath": "/etc/liveswitch/redis-tls/tls.key"
}
Setting Description
CertificatePath Required. Path to the client certificate, in PEM or PKCS#12 (PFX) format.
KeyPath Path to the PEM private key. Omit it if the certificate file is a PFX file, or a PEM file that also contains the key.
Password Password for an encrypted PEM key or a password-protected PFX file.
  • If an intermediate CA issued your client certificate, include the intermediate CA certificates in the certificate file after the client certificate. LiveSwitch sends them to Redis along with the client certificate.
  • The Cache connection string must enable TLS. Otherwise, the service doesn't start.
  • LiveSwitch loads the certificate when the service starts. After you replace the certificate files, restart the service.
  • You can also set these values with environment variables, for example CacheClientCertificate__CertificatePath.

When the certificate loads, the service logs a message that starts with Using Redis client certificate for mutual TLS.

Error Cause
tlsv13 alert certificate required (Linux) or The message received was unexpected or badly formatted (Windows) Redis requires a client certificate, but none is configured.
certificate verify failed in the Redis server log, or The certificate chain was issued by an authority that is not trusted (Windows) Redis can't verify the client certificate. Check that the certificate file includes the intermediate CA certificates.
Unable to load the Redis client certificate configured in "CacheClientCertificate" The certificate can't be loaded. The inner error shows why, for example a missing file or a wrong password.

Deployment ID

deploymentId specifies the deployment configuration to use for this service. If this value isn't set, LiveSwitch uses the default deployment configuration.

"deploymentId": "Deployment1"

Region

Region specifies the region of the server.

"Region": "Europe"

Media Server Configuration

The Media Server configuration includes extra settings required for the embedded TURN Server.

Internal IP Addresses

The internal IP addresses used for Media Server clustering. Defines addresses for Media Server to Media Server traffic when, for example, downstream connections are on different servers than their related upstreams.

"Internal": {
  "IPAddresses": []
}

External IP Addresses

The local IP addresses that control which network interfaces to bind sockets to for media connections. If unset, LiveSwitch automatically binds to all available interfaces, which is the typical configuration.

"External": {
  "IPAddresses": []
}

Public IP Address

The public IP addresses of the Media Server seen by remote clients. Used for:

  • Server reflexive candidates in SDP answers
  • STUN/TURN server URLs provided to client SDKs

Accepts comma-separated values for multiple addresses (e.g., both IPv4 and IPv6). If unset, the external STUN URLs configured in the Deployment Configuration are used to retrieve it.

"External": {
  "PublicIPAddress": "203.0.113.50, 2001:db8::1"
}
Note

Both PublicIPAddress (singular) and PublicIPAddresses (plural) are accepted and function identically.

Public Hostname

The hostname of the Media Server. This value is mandatory if you have configured TURNS Bindings.

"External": {
  "PublicHostname": "media.example.com"
}

TURNS must have a public host name. All traffic to the Media Server must include this host name, which is then compared to the host name in your certificate. A TURNS connection can only happen when these two match.

Note

When you start a Media Server to accommodate increasing load, you must create the host name for the embedded TURNS server that the new Media Server uses. You must create the necessary DNS record and also supply the new host name as part of the TURNS configuration of the new Media Server. When you remove Media Servers, you can clean up the DNS records for the TURNS domain names that are no longer required.

Reset Configuration Console Password

You can reset the password to your LiveSwitch Console using the LiveSwitch command-line tool that's installed with your Gateways.

FM.LiveSwitch.Cli.exe reset password --user=<current_username> --password=<new_password>