Solved 3CX SIP Trunk with TLS issue

[Kwang Mien]

Hi,

I am using 3CX Version 18 update 5.

I have configured the SIP Trunk in 3CX to use TLS based on the instruction in https://www.3cx.com/docs/sip-trunk-tls-srtp/

The provider is using the SSL certificate from Let's Encrypt. I uploaded the CA certificate given by the provider to the SIP Trunk.

However, when registering the SIP Trunk to the provider, 3CX responded with "Unknown CA". Please refer the below from the wireshark capture



The correct CA certificate has been uploaded to 3CX SIP Trunk. Can anyone advise what could be the issue ?

Thanks.

Regards,
Kwang Mien

 

[Evolute IT]

What provider do you use?

 

[Kwang Mien]

What provider do you use?

The provider is one of our test server. It is using the Let's Encrypt SSL certificate.

 

[Evolute IT]

The provider is one of our test server. It is using the Let's Encrypt SSL certificate.

The provider is not a supported one?

 

[YiannisH_3CX]

The correct CA certificate has been uploaded to 3CX SIP Trunk. Can anyone advise what could be the issue ?

You need the root certificate of Let's Encrypt added to 3CX I think its the ISRG Root X1 for most cases.
Also Unknown CA might mean that your server might advertise a different CNAME than the one you are using as a registrar.

There are multiple parameters that should add up to have a successful TLS handshake so double check everything.

 

[Kwang Mien]

You need the root certificate of Let's Encrypt added to 3CX I think its the ISRG Root X1 for most cases.
Also Unknown CA might mean that your server might advertise a different CNAME than the one you are using as a registrar.

There are multiple parameters that should add up to have a successful TLS handshake so double check everything.

During the TLS handshake, the CA that the server advertise is as below



However, the CA cert that i uploaded to the SIP Trunk has the CName as below. They are similar but not exactly the same. Could this result in "Unknown CA" ?

 

[Kwang Mien]

The provider is not a supported one?

We have setup a Test Asterisk server acting as a provider which is loaded with the Let's Encrypt SSL certificate.

 

[Kwang Mien]

Hi All,

I have found the issue to be the missing Root Certificate in the CA Bundle certificate. after putting in the Root Certificate , 3CX is able to register to Asterisk via TLS

Pls also note that the certificate used was from SSL for Free and not Let's Encrypt.

Regards,
Kwang Mien

 

[YiannisH_3CX]

Glad to see you were able to resolve your issue