Twilio SIP Trunk Failing with TLS

[keeb]

I have a Twilio SIP trunk configured and working for outbound calls. then I make these changes:

1. I activate secure trunking @ Twilio
2. Under the Twilio trunk options in 3CX:
   1. Change transport protocol to TLS
   2. Upload the Twilio SIP root certificate from https://www.twilio.com/docs/sip-trunking#securetrunking (https://www.twilio.com/resources/images/docs/cacert.pem)
   3. Select SRTP
   4. Save

Then I place a test call and the 3CX event log shows:
Call or Registration to +1<10 digit phone #>@(Ln.10000@Twilio) has failed. 0.0.0.0 replied: 503 Certificate Name Mismatch; warning: No other DNS entries to try (10,0); internal

At first I thought I'm missing an intermediate certificate, but Twilio doesn't provide one.

Any ideas?
Thank you

 

[eddv123]

Yes, firstly out of all SIP providers I have used I find Twilio the best due to the troubleshooting options you have.

So on Twilio go to trunk in the Elastic SIP trunking section >> Search bar (Go To) >> type "call logs"

This will give you the call logs, if you click on a suspect call, you can download the PCAP from Twilios side - it could give you more information as to the issues at their end.

The thing with TLS traffic is that it could potentially be masked in Wireshark.

 

[keeb]

Yes, firstly out of all SIP providers I have used I find Twilio the best due to the troubleshooting options you have.

So on Twilio go to trunk in the Elastic SIP trunking section >> Search bar (Go To) >> type "call logs"

This will give you the call logs, if you click on a suspect call, you can download the PCAP from Twilios side - it could give you more information as to the issues at their end.

The thing with TLS traffic is that it could potentially be masked in Wireshark.

Thank you for the reply. Unfortunately, none of my attempted calls show in the Twilio logs whatsoever. I'm pretty sure 3CX is unable to verify their certificate and the call stops right there?

 

[eddv123]

What I am trying to grasp from this is which end the issue is with, I am going to say with some confidence Twilio (since you have had a 500 style server side response). If you ran a PCAP from 3CX then you would probably see this response from them: https://www.3cx.com/docs/capture-network-traffic/

I would then first check the Twilio help centre: https://support.twilio.com/hc/en-us...g-Certificate-Errors-from-the-Twilio-REST-API

And failing that contact Twilio support [email protected] they have a very good support team in the States who respond pretty quickly.

 

[keeb]

Thanks for your efforts.... I too am trying to confirm the side responding with the error, but being that Twilio has no record of an error and 3CX does, I'm fairly confident I'm unable to verify their certificate..... and I guess there is no way to temporarily override certificate verification to prove it works? I wrote support for additional assistance and specifically asked abut any intermediate certs. TY

 

[eddv123]

I too am trying to confirm the side responding with the error

If you are getting a 5xx this is a server side response (Twilio) since it is TLS however it may not come up with anything: https://www.3cx.com/pbx/sip-responses/

I guess calls work fine when dialling normally (no TLS) ? I would also be keen to hear their response as we use Twilio all the time, however have not had a request for TLS support from clients yet, but am sure it will happen one day.

 

[keeb]

Correct - outbound calls complete fine with TCP instead of TLS

 

[keeb]

I recreated the trunk and now I get:
Registration at Twilio has failed. Destination (sip:xxx.pstn.twilio.com:5061;transport=TLS;lr;maddr=54.172.60.3) is not reachable, DNS error resolving FQDN, or service is not available.

Yet I can ping my twilio uri from the 3cx instance.... Any ideas now?

 

[eddv123]

Yes, check the "Auto Discovery " box on the Twilio SIP trunk. If you do an nslookup to your Twilio FQDN does it resolve correctly ?

Although this is a release behind (auto discovery did not arrive until v16) you might want to run through this guide again and see if all is configured correctly: https://www.3cx.com/docs/twilio-elastic-sip-trunking/

Note: I did have a DNS related issue once with Twilio which I by-passed by configuring the proxy address as Twilios server IP's.

 

[keeb]

Auto discovery is checked.
Yes, an nslookup is successful
That link you sent states TLS is not supported with Twilio?!?!?!

 

[eddv123]

Well theres your answer then as I said I have never had to use TLS with them before, I would however still check with them and confirm it as the guide is for version 15.5 of 3CX which is outdated.

 

[keeb]

FYI - I have have tried multiple reinstalls, the AWS AMI image, 2 SIP providers (Twilio and Plivo), custom certs and 3cx domains...... SIP Trunk TLS refuses to work - period. Someone from 3CX please prove me wrong.... I need this to work and I have spent days on this.

 

[JohnS_3CX]

https://www.3cx.com/docs/twilio-elastic-sip-trunking/#h.pou3j4x86a0f

TLS is not supported on this provider.

 

[eddv123]

@JohnS_3CX That guide is vastly outdated, so please confirm if it is still the case for v16. It would be worth also feeding up the chain to update this guide as well as there are some minor differences.

 

[keeb]

John, Thank you.

Is this also the case for Plivo? I am gettign the same errors as Twilio.
Can you tell us what providers do support TLS?
Can you tell us why Twilio is not supported? Is this an issue you need to resolve or them?

TY

 

[keeb]

Inbound calls complete with Twilio with Secure Trunking enabled, so is TLS just not supported with them for outbound calls?

 

[cobaltit]

SIP Trunk TLS refuses to work - period. Someone from 3CX please prove me wrong.... I need this to work and I have spent days on this.

Would you mind sharing why you need this to work as I haven't come across this as requirement for anything.

 

[keeb]

I'm not trying to be sarcastic, but....
If I was supporting the customer service line for a popcorn maker - no problem.
If I'm supporting an insurance office that collects all kinds of personal information - problem.

 

[cobaltit]

Still don't see the need. I see the want, but not the need. There's no requirement (at least in the US as far as I'm aware) for encryption for voice traffic. There's several regulatory standards for data at rest, but nothing for voice in transit. Hence why I asked what the need was.

 

[YiannisH_3CX]

Hello @keeb

Please note that Twilio is not supported with TLS because they use a wildcard certificate and 3CX does not support wildcard certificates for TLS. For TLS to work the PBX needs to be able to match the certificate domain with the registrar of the provider.
Inbound calls will work with Twilio because the TLS handshake is reverse and accepted.

We haven't tested Plivo for TLS but seeing that they use a different registrar for each client then i would suspect the same will apply.