SIP TLS and SRTP on softphones

[Elvin.H]

Hi all.

We are trying to enable SIP TLS and SRTP on Windows softphones. We are using custom FQDN. When switching extensions to SIP TLS, softphones can't register. We have tried both Digicert certificates and issued by domain CA, and both of them are trusted on Windows hosts. SIP TLS works well on Snom IP phones with these certificates. Can't understand what's wrong and how to troubleshoot.

Anyone can help?

 

[Evolute IT]

The reason is simple, the app uses the tunnel. When using the tunnel, you can't use SIP TLS+SRTP because the call is already encrypted through the Tunnel protocol.

 

[Elvin.H]

The reason is simple, the app uses the tunnel. When using the tunnel, you can't use SIP TLS+SRTP because the call is already encrypted through the Tunnel protocol.

3cx tunnel is disabled for this extension - "Use 3CX Tunnel for remote connections" is unchecked. Or it should be disabled from somewhere else?

 

[Evolute IT]

3cx tunnel is disabled for this extension - "Use 3CX Tunnel for remote connections" is unchecked. Or it should be disabled from somewhere else?

Then it just won't work. The apps are not designed to work like that.

Keep it on the tunnel. It's much easier and supported. SIP TLS isn't at the moment.

 

[Elvin.H]

Then it just won't work. The apps are not designed to work like that.

Keep it on the tunnel. It's much easier and supported. SIP TLS isn't at the moment.

It means that this function is not working? How can it be?

Not sure about tunnel's stability and proper encryption. Softphones sometimes switch to tunnel, sometime don't.

 

[Evolute IT]

It means that this function is not working? How can it be?

Not sure about tunnel's stability and proper encryption. Softphones sometimes switch to tunnel, sometime don't.

They should always use the tunnel if it's enabled. Otherwise the app won't work correctly.

Use it as intended or use deskphones, but what I am saying is: SIP TLS was never meant to work with the softphones.

 

[Elvin.H]

They should always use the tunnel if it's enabled. Otherwise the app won't work correctly.

Use it as intended or use deskphones, but what I am saying is: SIP TLS was never meant to work with the softphones.

Thanks for replies, Frederick.

We'll try to reach support, for more official solution.

 

[VasilisV_3CX]

Hi @Elvin.H

If the Windows Client is on the same LAN as the PBX (Local LAN), then SIP TLS will probably not work because the Windows App is contacting the server using the IP, and the problem is that the certificate is issued to the FQDN.

Because the Windows App uses strict TLS, this is probably what is happening, again, IF it's on the same local LAN.

The only way to make it work over TLS on the Local LAN, is if they have a split DNS setup, where the client on the Local LAN can use the FQDN to contact the server. If a split DNS exists, they must select the FQDN in the Drop-Down in the Extension settings.

 

[Elvin.H]

Hi, @VasilisV_3CX

What exactly means on the same LAN? They are both in corporate network, but in different subnets and contact each other via routing. In extension's settings, as "Network interface for registration and provisioning" FQDN is selected.
I've analyzed traffic during registration process, and it doesn't seem a certificate issue. SSL session establishes well.