Solved TLS Sip Trunking not able establish

[tsong]

Hi All,

i need help to establish an ip based tls sip trunk

the provider had give me cert in pem.

i configured the trunk and choose tls as transport then i upload the cert into it and it appear the expires date year 2026

i had done enable pci compliance
i had enable secure sip
i had done restart the sip service

but i still not able make call.

i not able see the trunk is registered or not as the trunk is ip based.

i only found one related line in the activities log as below
Lc:10010(@star[<sip:0/UDP>]) Resolving targets: primary - sip:111.222.33.44:5061, no secondary over +TLS+IPv4

what it mean no secondary over + TLS + IPv4 ?
how can i fix this trunk?

 

[YiannisH_3CX]

Hi @tsong

There are a number of requirements for TLS to work. The first is to have a registration based trunk. 3CX does not support TLS for IP based trunks.
Then your registrar must be an host name. 3CX does not support TLS when an IP address is used as a registrar or proxy address.
Also your certificate must be the root certificate that was used to sign the certification chain leading to the certificate for your host name. (unless you are using a self-signed certificate).
And of course the 2 servers must be able to complete the TLS handshake.

 

[tsong]

Hi @YiannisH_3CX

thank you so much for the info given.

Now i know why it not working.
1. the provider using IP Peering = X
2. the provider require proxy = X

unless my trunk provider can change to registration base and no proxy, this then the trunk should able to work correctly correct ?

 

[YiannisH_3CX]

unless my trunk provider can change to registration base and no proxy, this then the trunk should able to work correctly correct ?

You definitely need a registration based SIP trunk with no IP address as proxy. If the proxy is a host name then there is no problem. If you get these 2 right then you need to ensure you have the right certificate and it should work. Without testing it however you can never know for sure. The 2 platforms need to agree on ciphers TLS version etc so the only way to know is to test it.

 

[tsong]

Hi @tsong

There are a number of requirements for TLS to work. The first is to have a registration based trunk. 3CX does not support TLS for IP based trunks.
Then your registrar must be an host name. 3CX does not support TLS when an IP address is used as a registrar or proxy address.
Also your certificate must be the root certificate that was used to sign the certification chain leading to the certificate for your host name. (unless you are using a self-signed certificate).
And of course the 2 servers must be able to complete the TLS handshake.

this info very important. thank you so much and i will close the threads.


thank you

 

[YiannisH_3CX]

Glad I could assist. I will proceed closing the thread but feel free to create a new one if you face any issues.