We want to implement a Asterisk version 16.x at a customer site and their PBX partner has only ‘certified’ the version 13.x of the Asterisk. So we’re on the brink of re-certification. However if the SIP stack didn’t change over those past years then re-certification is not needed.
That depends on what “SIP stack didn’t change” actually means. There are two channel drivers for SIP, chan_sip and chan_pjsip. They each use their own stack. The chan_sip module rarely, if ever, receives changes. The chan_pjsip module does receive changes and also is updated to new versions of the PJSIP stack.
The chan_sip module is a self-written SIP implementation which has been deprecated. The chan_pjsip module uses a third party SIP stack called PJSIP by a company called Teluu.
With (nearly) each (minor) Asterisk release, the SIP channel driver(s) changes. Consequently, a statement like ‘13.x’ was rather useless already because even back then two SIP channel drivers existed. Which one did they support, or even both? And I would not call Asterisk 13.0.0 the same as Asterisk 13.38.3, seven years apart.
Those certified statements better suite closed-source phone systems which only patch security fixes but do not improve interoperability or fix bugs over time. Therefore, bad news: You have to run tests yourself before upgrading a live system. Actually, you should have Asterisk 16 LTS in place already and do your tests with Asterisk 18 LTS. The good news: Thanks to Asterisk’s openness you can roll-back changes and/or start in-depth investigations of the bugs yourself.
Long story short, there is a easy answer to your question. It is simply work to be done.