Solved What type of certificate is required for using TLS between 3CX and your SIP provider?

[patrickc]

I am trying to set up TLS between my 3cx PBX and my SIP provider. When you go to "Options" within the SIP Trunk and set "Transport Protocol" to "TLS", a new form field appears asking you to submit a "TLS Root Certificate". Can someone please clarify exactly which certificate is required here as i'm not sure which of the following two things are happening:

1. Is this 3CX asking us to upload a client certificate that it will present to the SIP provider's server (similar to when mutual/two way TLS is used and the client needs to present a valid certificate to the server as well as the server present one to the client? OR
2. is 3CX only using server certificates (non-mutual TLS) and it wants the root certificate of the certificate authority used to sign the certificate on/presented by the SIP provider's server? IE in the same way browsers have a tusted root store of valid certificate authorities, 3CX needs us to install the certificate authority into its trusted root store so that it can very the signature on the certificate it receives from the SIP provider's server on the TLS handshake?

The documentation simply says to upload the certificate provided by the SIP provider. It would be helpful if the documentation could make this clearer.

 

[Evolute IT]

You would upload the provider's CA certificate there.

Check out Telnyx's docs on 3CX SIP trunks. There's the how-to enable TLS on Telnyx.

 

[patrickc]

Thanks for your reply. I have also found this article, which is helpful: https://www.3cx.com/community/threads/tls-sip-trunking-not-able-establish.83897/#post-392334

There are a number of requirements for TLS to work. The first is to have a registration based trunk. 3CX does not support TLS for IP based trunks.
Then your registrar must be an host name. 3CX does not support TLS when an IP address is used as a registrar or proxy address.
Also your certificate must be the root certificate that was used to sign the certification chain leading to the certificate for your host name. (unless you are using a self-signed certificate).
And of course the 2 servers must be able to complete the TLS handshake.

It would be useful for others if this info was in the 3CX documentation.

 

[YiannisH_3CX]

2. is 3CX only using server certificates (non-mutual TLS) and it wants the root certificate of the certificate authority used to sign the certificate on/presented by the SIP provider's server? IE in the same way browsers have a tusted root store of valid certificate authorities, 3CX needs us to install the certificate authority into its trusted root store so that it can very the signature on the certificate it receives from the SIP provider's server on the TLS handshake?

Exactly this one. We do not read the OS root certificates pool so you need to upload the root certificate used to sign the providers cert.

It would be useful for others if this info was in the 3CX documentation.

We are working on a document that will include all these information and more. Thank you for the feedback

 

[patrickc]

Many thanks for the reply