Configuring the Experience Portal to use MRCPv2/TLS with SIPS and SRTP

By default, the MRCP traffic between Avaya Aura Experience Portal (AAEP) and Capacity Private Cloud is unencrypted — both the MRCPv2 signaling and the RTP audio travel in the clear. This guide secures that path end to end: MRCPv2 over TLS (SIPS) protects the signaling channel, and SRTP encrypts the media stream. You will generate the certificates, trust them in AAEP, and configure the ASR and TTS speech servers to use TLS transport (port 5061) with an SRTP profile.

Before you start, the platform's ASR and TTS must already be installed and available as a LumenVox server type in AAEP. On AAEP 7.x that requires updating two language properties files — see Update Avaya language properties (which also hosts the languages.properties_lib and languages.properties_webapps files referenced below). For the standard, non-encrypted integration, see Avaya Experience Portal (AEP) 7.

Prerequisites

  • Install the Capacity Private Cloud Media Server, License Server, and the TTS and/or ASR server.
  • Make the LumenVox ASR/TTS server type available in AAEP using the languages.properties_lib and languages.properties_webapps files — see Update Avaya language properties.
  • Generate the certificates used for SIPS and MRCPv2/TLS. You may use the same certificate for both, but using separate certificates is more secure.

Generate the Certificates

The following example generates a self-signed certificate with OpenSSL. This is only one option — any method that produces a valid key and certificate will work.

Note: The subject fields below (O, OU, CN, emailAddress, and the file paths under C:/temp/certs) are examples. Replace them with values appropriate to your own organization and environment.

a. Generate the private key:

openssl req -out C:/temp/certs/SampleSips.csr -new -newkey rsa:2048 -nodes -keyout C:/temp/certs/SampleSips.key -subj "/C=US/ST=California/L=San Diego/O=LumenVox/OU=LumenVox/CN=LumenVox/emailAddress=support@lumenvox.com" -config ../openssl.cnf

b. Generate the certificate:

openssl x509 -signkey C:/temp/certs/SampleSips.key -in C:/temp/certs/SampleSips.csr -req -days 1825 -out C:/temp/certs/SampleSips.crt

c. Combine the key and certificate into a PEM file:

type C:\temp\certs\SampleSips.key C:\temp\certs\SampleSips.crt > C:\temp\certs\Sips.pem

Windows command prompt running the OpenSSL commands to generate the key, certificate, and PEM file

Figure 1: Running the OpenSSL commands in a terminal to generate the certificate files.

Upload the Certificate to Experience Portal

  1. Log in to Experience Portal and select Certificates under Security in the left menu.

AAEP left navigation menu with Certificates highlighted under Security

  1. Open the Trusted Certificates tab.

AAEP Certificates page with the Root Certificate and Trusted Certificates tabs

  1. Click Upload.

AAEP Trusted Certificates tab listing certificates with the Upload button

  1. Give the certificate any name you like, and choose Speech Server from the Type drop-down.

Upload Trusted Certificate page with the Type drop-down set to Speech Server

  1. Click Choose File, select the .crt file you generated, then click Continue.

Upload Trusted Certificate page with a file picker selecting SampleSips.crt

  1. Review the certificate details and click Save.

Upload Trusted Certificate confirmation page showing the certificate details and the Save button

  1. Restart the EPM from the EPM Manager.

Configure the Speech Servers

Add the ASR and TTS speech servers under System Configuration > Speech Servers.

AAEP left navigation menu with Speech Servers highlighted under System Configuration

Add the ASR Server

On the ASR tab, click Add.

AAEP Speech Servers ASR tab with the Add button

Use the following settings. The values that deviate from AAEP's defaults must be set carefully — note in particular the TLS transport and base/listener port 5061:

  • Enabled: Yes
  • Engine Type: LumenVox
  • Network Address: <IP of the host running the platform>
  • Base Port: 5061
  • Total Number of Licensed ASR Resources: <number of licenses installed>
  • New Connection per Session: Yes
  • Languages: en-US (or other installed ASR languages)
  • Ping Interval: 15
  • Response Timeout: 4
  • Protocol: MRCP V2
  • Transport Protocol: TLS
  • Listener Port: 5061

Under SRTP, add at least one configuration to the Configured SRTP List. The example below enables SRTP with the following values, then clicks Add:

  • Enable: Yes
  • Encryption Algorithm: AES_CM_128
  • Authentication Algorithm: HMAC_SHA1_80
  • RTCP Encryption Enabled: No
  • RTP Authentication Enabled: Yes

AAEP Add ASR Server form with Engine Type LumenVox, MRCP V2 over TLS on port 5061, and an SRTP profile configured

Figure 2: Sample ASR configuration with MRCP V2/TLS on port 5061 and an SRTP entry in the Configured SRTP List.

Click Save.

Add the TTS Server

On the TTS tab, click Add.

AAEP Speech Servers TTS tab with the Add button

Use the same approach as the ASR server. The values that deviate from AAEP's defaults must be set carefully, and at least one configuration must be added to the Configured SRTP List:

  • Enabled: Yes
  • Engine Type: LumenVox
  • Network Address: <IP of the host running the platform>
  • Base Port: 5061
  • Total Number of Licensed TTS Resources: <number of licenses installed>
  • New Connection per Session: Yes
  • Languages: en-US
  • Ping Interval: 15
  • Response Timeout: 4
  • Protocol: MRCP V2
  • Transport Protocol: TLS
  • Listener Port: 5061

Configure the same SRTP values as the ASR server (AES_CM_128 / HMAC_SHA1_80), then click Add.

AAEP Add TTS Server form with Engine Type LumenVox, MRCP V2 over TLS on port 5061, and an SRTP profile configured

Figure 3: Sample TTS configuration with MRCP V2/TLS on port 5061 and an SRTP entry in the Configured SRTP List.

Click Save, then restart the MPP from the MPP Manager.

Related Articles

Was this article helpful?