Telekom and SIP TLS - 503 Certificate Validation Failure

[Gerhard_]

I have read a lot of threads by now, but none helps.

With TCP, the provider settings work, when I switch to TLS, they don't.

Log Reader says: Cause: 503 Certificate Validation Failure/REGISTER from local

Wireshark says: TLSv1.2 61 Alert (Level: Fatal, Description: Unknown CA)

I downloaded the root certificate (Class 2) from "https://www.telesec.de/de/root-programm/informationen-zu-ca-zertifikaten/root-zertifikate/" , this is the official cert for TLS SIP (Deutsche Telekom / German Telekom).
(I tried Class 3 as well, did not work neither)

Then I looked up the server itself -> tel.t-online.de
SRV record says:
_sips._tcp.tel.t-online.de SRV service location:
port = 5061
svr hostname = m-eps-110.edns.t-ipnet.de
port = 5061
svr hostname = h2-eps-100.edns.t-ipnet.de
port = 5061
svr hostname = d-eps-100.edns.t-ipnet.de

with IPs
m-eps-110.edns.t-ipnet.de internet address = 217.0.27.163
h2-eps-100.edns.t-ipnet.de internet address = 217.0.29.36
d-eps-100.edns.t-ipnet.de internet address = 217.0.28.34

The following command connects and checks the certs:
openssl.exe s_client -showcerts -connect 217.0.28.34:5061

The same (Class 2) root certificate is there and also the "tel.t-online.de".

I tried all those certificates as "root" certificate in the 3cx trunk options (base64 encoded and .pem file).

None did work.

What am I missing?

Is use on-prem 18.0 U2 (Build 314) Enterprise on Windows Server 2022.

Thank you.

 

[YiannisH_3CX]

Hi @Gerhard_

As you may already know 3CX does not support TLS with any of Deutsche Telekom trunks as Deutsche Telekom have their own way of doing things which are not always compatible with the rest of the world.
Honestly I have not tested TLS with Deutsche Telekom's All IP trunk (i am assuming that is what you using) so I cannot really say why it does not work.
The error seems to suggest that there is something wrong with the certificate so make sure you converted it to .pem from .cer and not just renamed it.
The certificate check also has to do with what the specific server advertises its common name to be which might not necessarily be the same as what is in the root certificate.