Questblue & SIP TLS

[mpruett]

I'm trying to switch to tls on my questblue sip truck. I see that I am required to provide a root cert in the config. From what I've gathered browsing the forums I would need to get the root cert from questblue correct? I saw stated elsewhere on the forums that 3cx does not ship with ssl roots built in, which is why they must be provided? Lastly, am I correct that the following indicates that they are using a self signed cert here? I assume 5061 is the correct port for questblue tls?

main:/etc$ openssl s_client -showcerts -verify 5 -connect sbc.questblue.com:5061 < /dev/null
verify depth is 5
CONNECTED(00000003)
depth=0 C = AT, ST = Some-State, O = Sipwise GmbH, CN = Sipwise GmbH, emailAddress = [email protected]
verify error:num=18:self-signed certificate
verify return:1
depth=0 C = AT, ST = Some-State, O = Sipwise GmbH, CN = Sipwise GmbH, emailAddress = [email protected]
verify return:1
---
Certificate chain
0 s:C = AT, ST = Some-State, O = Sipwise GmbH, CN = Sipwise GmbH, emailAddress = [email protected]
i:C = AT, ST = Some-State, O = Sipwise GmbH, CN = Sipwise GmbH, emailAddress = [email protected]
aKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
v:NotBefore: Feb 3 14:00:39 2021 GMT; NotAfter: Oct 31 14:00:39 2023 GMT
-----BEGIN CERTIFICATE-----
MIIFdDCCA1ygAwIBAgIUBM2mvcYaSyLZQy8GmzK16l0dN0QwDQYJKoZIhvcNAQEL
BQAwdDELMAkGA1UEBhMCQVQxEzARBgNVBAgMClNvbWUtU3RhdGUxFTATBgNVBAoM
DFNpcHdpc2UgR21iSDEVMBMGA1UEAwwMU2lwd2lzZSBHbWJIMSIwIAYJKoZIhvcN
AQkBFhNzZXJ2aWNlQHNpcHdpc2UuY29tMB4XDTIxMDIwMzE0MDAzOVoXDTIzMTAz
MTE0MDAzOVowdDELMAkGA1UEBhMCQVQxEzARBgNVBAgMClNvbWUtU3RhdGUxFTAT
BgNVBAoMDFNpcHdpc2UgR21iSDEVMBMGA1UEAwwMU2lwd2lzZSBHbWJIMSIwIAYJ
KoZIhvcNAQkBFhNzZXJ2aWNlQHNpcHdpc2UuY29tMIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEAy06H7FlIuHqdZCWEj8q11HnPFT7h9jvOOrlKTVgu4pGE
tLJzak35VCMYB3gni5v5jgNOm8t7OjJ9XDFS8VUBW4SMBqMnpcLOpzpwO6rcR3TI
cgbyAzwMczsDQp/3eLcj/Waq8RHz5HF2xUozJlK1g9zd0INSyq0o7dBXOhQj4vt7
UWuzS8ghrvtlsoFKk2VQOElpOWULqK0SZly6+TnSJJiWjCAI8pmMedkYJ2rDwbPZ
03TxTSr8+JSBa15P738sy+/6fPuOOxiWq6meaNI8q82DuMCtN5qfMowQc5LL9y4k
ru6x1GUsbz2hLbEjCvo7uWmy3UqfLw368rx3RA9YHdi8HAO4UTqXGiD5JVQCnvIj
ke+geqh3+X/mhKcvYU40Nt1oorI75NUaIZ7SUCqadfCMNW5ZzzN+rQmjo4PQscsk
q7AekhajzbrUWiOvMnCCG8V+xqiKiFD+wJJ+mL/u5bOxempzO1Xg/q0cXiuu1nmr
x8+xtHhpecZm5Pb2Yo1oxMwhF4EIsDkAIO0R3RN6kiHuCwBAxxxM7HCZTSet+yzs
0S0fiOGykJRGXz1YPOqxizNI1PydwudIsXFU/OccmRkK+d0kov1zteFCQp6RYWF1
RIFIGAJAlKsff4D70GBg14D+9tIbPhsOXMBFXLHIgmo1hqfyQPiOaIetvi5FIg8C
AwEAATANBgkqhkiG9w0BAQsFAAOCAgEAuvDpU+i4zy5Bvk1oZAZ9M6hjq3ixmQhn
CBKq4AkRqTuaorvEB9bfsq+J/ip0g6VD+UkNfTOzQrcxsYaAPtnP1DxI5JSHUM9x
FZxCtBPE/gX79+x7rfd7RJqcTs1sT3ixccfcHEmhyW6NFEL7617Km/Qf/lixc6mv
jApqjXFNnZB0GkJ74MUNE5iNWvsQtpxFa1M2Iy+RQy6eO3g/UQfInjfIjl94NbgI
OfvbpmTGTCNCVviz7MfNVgayTMWoqQ731GaXGjXCYQx0dEKyQiBoiSWxUL58cjnO
69LbTzvQTy+PQShF7d93UBVzU0FrCGM+sW03DdjMOQL0NqPm5X8EepYmKepP9HJN
YSWsLB7ksUOtAtqxjnzcXbTeUN+AM2NdeL+2USiD4x0XqTvjSIYawgjUdtElT9Bu
A33Wr1Qa7dr277557WunP0NlNHd9tv5Ogp7T1EbcolD+VOOZm4pNz6h9At+Nr79o
OpTcyayCUd8W0lTgzN+CJYMi8VmEe4KlZdyWgHeVlkIxXz5LG6la9MX7F+e6IPE4
w+ZycGS3+Yo7Xnx0La97P5oO885J0ooLWclzWrvEBRqwfFWdKks8LXW0yRu98DsJ
piNUdg+V4fRnENB89VTmvNBs5gpTpXea6jV+WY9NTEYtSimBwldmzyBewr+eSA+X
uRtu18Zxxo0=
-----END CERTIFICATE-----
---
Server certificate
subject=C = AT, ST = Some-State, O = Sipwise GmbH, CN = Sipwise GmbH, emailAddress = [email protected]
issuer=C = AT, ST = Some-State, O = Sipwise GmbH, CN = Sipwise GmbH, emailAddress = [email protected]
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: ECDH, prime256v1, 256 bits
---
SSL handshake has read 2342 bytes and written 759 bytes
Verification error: self-signed certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
No ALPN negotiated
Early data was not sent
Verify return code: 18 (self-signed certificate)
---
DONE

 

[Evolute IT]

Normally you just need the file from the provider, self-signed or not doesn't matter, and set it under that field when choosing TLS as transport.

Port needs to be set to 5061 unless you're using Autodiscover in the trunk general settings, in which case the 3CX does a DNS SRV lookup instead of find the port.

 

[YiannisH_3CX]

Hi @mpruett

As 3CX only supports the QuestBlue IP based trunks TLS is not supported. This might change however in the near future as we are planning to interop the authentication based trunks from QuestBlue and TLS will be tested as well. Keep an eye out for that.