TLS support on 3CX with no certificates
Hi everyone,
I'm trying to connect a registration-based SIP trunk from a local carrier in Hawaii to 3CX v20.
We currently use Telnyx, which works perfectly over UDP, but we'd like to keep a large block of numbers with our local provider instead of porting them.
The provider requires:
- Registration-based SIP trunk
- TLS (5061)
- SRTP
- Standard TLS (they confirmed mutual TLS is NOT required)
The trunk is configured with:
- Registrar:
[local provider domain] - Outbound Proxy:
[local provider proxy] - Transport: TLS
- Authentication ID and password supplied by the carrier
- DNS SRV resolution is working correctly
- 3CX resolves the SBC and attempts to register
The problem is that registration fails with:
503 Certificate Validation Failure
TLS handshake failed:
SSL_ERROR_SSL: no peer supplied certificate
error:0A000410:SSL routines::sslv3 alert handshake failure
The provider has confirmed:
- We are reaching the correct SBC.
- They do not require a client certificate (mTLS).
- A MicroSIP client registers successfully using the exact same credentials over TLS.
- No client certificate is configured on their trunk.
I've also verified:
- Public IP is allowlisted.
- DNS/SRV resolution is correct.
- Authentication credentials are correct.
- 3CX is sending the REGISTER request.
- OTG isn't involved yet (it's only required on outbound INVITEs).
According to the 3CX Activity Log, the failure occurs during the TLS handshake before SIP registration completes.
Has anyone seen this with a generic TLS SIP provider?
Specifically:
- Is there anything in 3CX that could cause this TLS handshake failure?
- Does 3CX require uploading the provider's root/intermediate CA certificate even when the provider is using standard TLS? The documentation mentions uploading the provider's root CA for TLS trunks, but I'm not sure if that applies here.
- Has anyone run into TLS compatibility issues (TLS version/cipher/SNI) with unsupported providers?
Any suggestions or similar experiences would be greatly appreciated.
Been working with my local provider in Hawaii to provide the SIP trunking to 3CX. We currently use Telnyx and works fine but good chunk of numbers are staying with the local provider so I am exploring options for SIP with them since it'll be easier than porting.
They require to have TLS to the SIP trunk and the we're having a hard time to get it work. The error given on the trunk analysis says 503 Certificate Validation Failure. I asked the provider to see if they can give me the certificate but they kept saying that it's not mTLS and standard TLS so shouldn't require the certificate from the provider.
Appreciate if someone can give me tips on having TLS on the SIP trunking..... Especially with no certs available from the provider.