Trunk TLS error: Certificate Name Mismatch

[it213]

Hello,

I would like to receive some help with registering with an unsupported provider.
I think I added a correct certificate in the trunk-config.
Filled in my own certificate and private key at SecureSip settings.
I see it tries to register and tries to validate the certificate, but somehow it gives a certificate mismatch:

Registration failed for: Lc:10000(@TrunkName[<sip:10000@REGISTERADDRESS:0/TLS>]); Cause: Cause: 503 Certificate Name Mismatch/REGISTER from local

The system is Broadvox

Can someone help me discover what I'm doing wrong.

Thanks in advance

 

[cobaltit]

Have you first established if it works without the certificate? And what does your provider say? And what regulation or certification are you trying to achieve with this?

 

[YiannisH_3CX]

For TLS to work the following must apply:

1. The certificate you input into the trunk settings must be the root certificate that was used to sign the providers certificate
2. The certificate must be for the registrar value used in the trunk settings and must match that exactly. Wildcard certificates do not work.
3. IP addresses do not work with TLS
4. If you have set an IP address in the outbound proxy of the trunk TLS will not work.
5. TLS works only with authentication based trunks.
6. The providers server must "advertise" the correct name and certificates during the TLS handshake including all necessary intermediate certificates.
7. If the provider does not have NAPTR / SRV records for TLS you need to set the port manually.

Like @cobaltit suggested make sure that your trunk works without TLS and then try to switch to TLS for further troubleshooting.

 

[it213]

Have you first established if it works without the certificate? And what does your provider say? And what regulation or certification are you trying to achieve with this?

The same settings will work, without TLS and changing the portnumber.
I'll go try to ask my provider if he can deliver me the certificate, because I try to download it myself, but maybe I'm doing something wrong.

 

[it213]

For TLS to work the following must apply:

1. The certificate you input into the trunk settings must be the root certificate that was used to sign the providers certificate
2. The certificate must be for the registrar value used in the trunk settings and must match that exactly. Wildcard certificates do not work.
3. IP addresses do not work with TLS
4. If you have set an IP address in the outbound proxy of the trunk TLS will not work.
5. TLS works only with authentication based trunks.
6. The providers server must "advertise" the correct name and certificates during the TLS handshake including all necessary intermediate certificates.
7. If the provider does not have NAPTR / SRV records for TLS you need to set the port manually.

Like @cobaltit suggested make sure that your trunk works without TLS and then try to switch to TLS for further troubleshooting.

1. Tried to download the RapidSSL TLS RSA CA G1 from the website, but gives me the name mismatch error.
2. when using openssl it shows me a CN same as the address i use.
3. don't use IP's
4. no IP's
5. we use Authentication.
6. I'll ask.
7. set the port manually

thanks in advance, I'll try to get answers from my provider.

 

[it213]

I received the .pem certificate from provider, but still the same message.
I can register with the same settings from microsip, so it ain't about the settings.
the only reason is somehow 3cx won't accept the certificate?
Ain't there an option to disable the certificate name check or something like that?

 

[cobaltit]

So you want to use TLS because it's secure but then you want to disable one of the things that makes it secure? That's like going to a website and saying eh, it's ok the name on the SSL doesn't match, let's just move forward. Is it encrypted still? Yes. Is it secure? Questionable. Certainly if you are trying to meet some sort of regulatory need that wouldn't be acceptable. And if you aren't, why bother?

But no, you can't disable the name checking.

 

[it213]

I don't WANT to use TLS, there is no other way for me because of some settings only available by TLS or in a seperate IPVPN..
To have an option, doesn't really mean you'll always need to do it that way, but no is an answer, thank you!

 

[YiannisH_3CX]

The answer to disable the name check is no, there is no way to do that. Can you share the registrar value of your provider?

 

[it213]

Ok, thanks.
here u are: sbc.sc.voipit.nl:5081

 

[YiannisH_3CX]

Thanks. Normally for supported providers we do the search and the check for the SSL certificates. I do not have an account for Broadvox so i cannot be sure this will work but you need the DigiCert Global Root G2 root certificate. That the one that was used to sign the RapidSSL cert your provider is using.

Try it and let us know.

 

[it213]

Thank you very much.. but same error..