TLS and SRTP do not work using SIP-Trunk "Deutsche Telefon"

[denko2k]

Setup:
PBX: 3CX (always latest stable version)
firewall: pfsense
IP: dynamic, changes every 24 hours
STUN-Servers: stun.3cx.com, stun2.3cx.com, stun3.3cx.com

Recently the SIP trunk provider "Deutsche Telefon" ("DTST") made an encrypted SIP trunk possible.
The encryption is based on TLS 1.0, SRTP on port 5061.

According to "DTST", the following settings must be made for encryption to work:

• SIP Trunk / General / Hostname / Port to 5061
• SIP Trunk / Options/ SRTP: on
• SIP trunk / Options / transport protocol on "TLS" (do not upload root certificate)

The SIP trunk can then no longer register.
The following error message appears:

SIP Server / Call Manager ID: 12293
Registration at DTST has failed. Destination (sip: sip.dtst.de: 5061; transport = TLS; lr; maddr = 92.60.210.92) is not reachable, DNS error resolving FQDN, or service is not available.

The firewall is configured correctly and allows TCP on port 5061.

Thanks for any help.

 

[YiannisH_3CX]

Hi @denko2k

Try to navigate to Settings / Security and under the "Anti-Hacking" tab make sure that the option "SSL/SecureSIP Transport and Ciphers " is not enabled.
Please note that this will reduce security and the PBX will accept TLS connections prior to V1.2.
If that fails then check Wireshark for the TLS handshake between the PBX and the provider. Perhaps that can provide a clue on who is resetting the connection.

 

[denko2k]

Hello @YiannisH_3CX

Thanks for your help.
Turning "SSL/SecureSIP Transport and Ciphers" OFF does not help.

But more details:

If "SSL/SecureSIP Transport and Ciphers" is ON:
the TLS alert is "protocol is not supported (70)"
I understand it that way: 3CX tries TLS 1.2 but the destination does not support TLS 1.2

Frame 5320: 51 bytes on wire (408 bits), 51 bytes captured (408 bits)
Null/Loopback
Internet Protocol Version 4, Src: XXX.XXX.XXX.XXX, Dst: 92.60.210.92
Transmission Control Protocol, Src Port: 63772, Dst Port: 5061, Seq: 266, Ack: 2918, Len: 7
Transport Layer Security
TLSv1 Record Layer: Alert (Level: Fatal, Description: Protocol Version)
Content Type: Alert (21)
Version: TLS 1.2 (0x0303)
Length: 2
Alert Message
Level: Fatal (2)
Description: Protocol Version (70)




If "SSL/SecureSIP Transport and Ciphers" is OFF:
the TLS alert is "Unknown CA (48)”
I understand it that way: 3CX tries TLS 1 but there is a problem with the certificate.

Frame 6939: 51 bytes on wire (408 bits), 51 bytes captured (408 bits)
Null/Loopback
Internet Protocol Version 4, Src: XXX.XXX.XXX.XXX, Dst: 92.60.210.92
Transmission Control Protocol, Src Port: 64151, Dst Port: 5061, Seq: 266, Ack: 2918, Len: 7
Transport Layer Security
TLSv1 Record Layer: Alert (Level: Fatal, Description: Unknown CA)
Content Type: Alert (21)
Version: TLS 1.0 (0x0301)
Length: 2
Alert Message
Level: Fatal (2)
Description: Unknown CA (48)



Could it be that the certificate of the provider "Deutsche Telefon" has to be imported into the 3CX?


BTW for "Deutsche Telefon":
TLS 1 is unsafe and should no longer be used.

92.60.210.92 = sip.dtst.de

 

[StefanW]

you need to add into the Trunk the Root CA which is the issuing company of the cert they use. Plz contact them. Also, make sure that your own SIP TLS is configured under Settings Security. And TLS 1.0 is deprecated... just FYI https://www.globalsign.com/en/blog/disable-tls-10-and-all-ssl-versions/

 

[denko2k]

@StefanW
Thank you. We will contact the provider.
It's clear. TLS 1.0 has been insecure for years.