Solved Hosted by 3CX - TLS not connecting with valid settings

[jrenshaw]

Hi,
I have followed the guide here and have been working with Brightstar, and we've hit a brick wall with enabling TLS on the trunk.
https://www.3cx.com/docs/brightstar-uk-sip-trunk/

I have double checked the settings so they match the guide but the trunk won't register and I'm currently getting these messages in the events;

Registration at Brightstar has failed. Destination (sip:sbc-004.brightstar.cloud:5061;transport=TLS;lr;maddr=77.108.130.28) is not reachable, DNS error resolving FQDN, or service is not available.

Brightstar can see the PBX attempting to connect on their side, and have said there isn't anything set to block the connection.

I have checked the Secure SIP settings and that has the certificate and public key set from when the instance was created, and I've also tried disabling SSL/SecureSIP Transport and Ciphers (as seen in another thread) to see if that had any effect in resolving the issue

Has anyone else encountered this before?

 

[YiannisH_3CX]

Hello @jrenshaw

What registrar are you using and what certificate are you using? Are you using the same ones as the guide?

 

[jrenshaw]

Hi @YiannisH_3CX ,
I am using Brightstar (UK), and am using the certificate that is provided within the guide

 

[YiannisH_3CX]

Yes which registrar are you using in your set up? Are you using "sbc-002.brightstar.cloud" or "sbc-004.brightstar.cloud" ? Also is Auto Discovery enabled?

 

[jrenshaw]

I've tried with both 002 and 004 but not had any luck, and auto discovery is enabled.

Brightstar can see the connection attempted so there seems to be an issue with 3CX making the TLS connection

 

[YiannisH_3CX]

I will send a p.m. shortly so we can check something together.

 

[YiannisH_3CX]

For those who are interested, the issue was with the Debian 10 new cipher requirements which were blocking the TLS connection. We solved it by making a small change in the OS.