Understand and verify DTLS-SRTP fingerprint exchange in WebRTC signaling

Steps

1. During SDP creation, each peer automatically generates a self-signed DTLS certificate and includes its SHA-256 fingerprint in the a=fingerprint:sha-256 attribute of the SDP offer or answer.
2. Exchange the SDP (offer/answer) between peers via your signaling channel; each peer extracts the remote fingerprint from the received SDP and stores it for later verification.
3. After ICE connectivity checks succeed, both peers perform a DTLS handshake over the ICE-selected candidate pair; each side verifies that the certificate presented in the handshake matches the fingerprint from the SDP.
4. If fingerprints match, DTLS derives the SRTP master keys (this is the DTLS-SRTP key exchange defined in RFC 5764); all subsequent media is encrypted with SRTP using those keys.
5. To troubleshoot DTLS failures, check the browser's WebRTC internals (chrome://webrtc-internals) for DTLS state transitions; a stuck 'connecting' state usually indicates a firewall blocking UDP or a certificate fingerprint mismatch.
6. As of 2025, modern browsers are migrating toward DTLS 1.3 (RFC 9147) and phasing out DTLS 1.0/1.1; ensure your SFU or media server supports at least DTLS 1.2, preferably 1.3.