# \[Help\] PJSIP WebRTC / WSS Registration Fails Despite Correct Credentials

**URL:** <https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725>\
**Category:** Asterisk WebRTC\
**Created:** [August 19, 2025, 8:16pm UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725 "2025-08-19T20:16:39Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![halim-kahraman](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/halim-kahraman/32/9377_2.png) [@halim-kahraman](https://community.asterisk.org/u/halim-kahraman)\
**Post date:** [August 19, 2025, 8:16pm UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/1 "2025-08-19T20:16:39Z")

</div>

Hi everyone,

we’re trying to use **Asterisk 20.6.0** as a middleware to connect **SIP.js** (WebRTC via **WSS** ) in the browser to our **FRITZ!Box SIP trunk**.  
The goal is:

- **Browser** → **Asterisk (WSS)** → **FRITZ!Box SIP Trunk** → **Outbound Call**  
We want to handle everything via WebRTC/SIP.js without exposing FRITZ!Box credentials to the frontend.

* * *

## **Setup**

### Environment

- **Asterisk Version:** 20.6.0

- **Database:** PostgreSQL (Realtime via ODBC)

- **Client:** SIP.js `0.21.1`

- **Transport:** `WSS` (Port 8089)

- **Browsers Tested:** Chrome, Edge

- **Use Case:** Outbound calls via FritzBox → Asterisk → Browser

* * *

## **Configuration**

### **pjsip.conf (global)**

```auto
[global]
type=global
user_agent=Asterisk-KCP
endpoint_identifier_order=auth_username,username,ip

```

* * *

### **Transport**

```auto
[transport-wss]
type=transport
protocol=wss
bind=0.0.0.0:8089
allow_reload=yes

```

* * *

### **Realtime Tables**

We’re using PJSIP-Realtime via ODBC (`res_odbc_pgsql.conf` → working).  
Here are the relevant table contents:

#### **ps\_auths**

| id | auth\_type | username | realm | md5\_cred |
| --- | --- | --- | --- | --- |
| sip-user | md5 | User1234 | asterisk | 65b97a58d1b12c151c6357b9a71b369f |

#### **ps\_endpoints**

| id | transport | aors | auth | context | allow | identify\_by |
| --- | --- | --- | --- | --- | --- | --- |
| sip-user | transport-wss | sip-user | sip-user | from-internal | opus,ulaw,alaw | auth\_username |

#### **ps\_aors**

| id | max\_contacts | support\_path |
| --- | --- | --- |
| sip-user | 2 | yes |

* * *

## **Problem**

Registration via SIP.js fails. Here’s a snippet from the **PJSIP logger** :

```auto
<--- Received SIP request (477 bytes) from WSS:85.216.xxx.xxx --->
REGISTER sip:sip.dtec-group.de SIP/2.0
Via: SIP/2.0/WSS dsn59428s1on.invalid;branch=z9hG4bK9153338
To: <sip:User1234@sip.dtec-group.de>
From: <sip:User1234@sip.dtec-group.de>;tag=m1mslc52h9
CSeq: 2 REGISTER
Contact: <sip:3tg17l3j@dsn59428s1on.invalid;transport=ws>;expires=600
User-Agent: SIP.js/0.21.1

<--- Transmitting SIP response (473 bytes) --->
SIP/2.0 401 Unauthorized

<--- Received SIP request (753 bytes) from WSS:85.216.xxx.xxx --->
REGISTER sip:sip.dtec-group.de SIP/2.0
Authorization: Digest algorithm=MD5, username="User1234", realm="asterisk", nonce="...", uri="sip:sip.dtec-group.de", response="bed81fbaaf2701922760bc53a948aea3"

[Aug 19 20:56:21] NOTICE[1390753]: res_pjsip/pjsip_distributor.c:673 log_failed_request:
  Request 'REGISTER' from '<sip:User1234@sip.dtec-group.de>' failed - Failed to authenticate

```

* * *

## **What We’ve Already Tried**

- ✅ Verified **MD5 hash** → correct (`MD5(User1234:asterisk:Test1234)`)

- ✅ Added `endpoint_identifier_order=auth_username,username,ip` → works

- ✅ Set `identify_by=auth_username` in `ps_endpoints`

- ✅ Enabled `support_path=yes` for WebRTC

- ✅ WSS transport works, port 8089 open

- ✅ Digest response from browser verified as **correct**

- ❌ Asterisk still returns `401 Unauthorized`

* * *

## **Questions to the Community**

1. Are there known issues with **SIP.js** + **Asterisk Realtime (ODBC)** + **WebRTC**?

2. Do we need extra configuration in **func\_odbc.conf** or **res\_odbc.conf** for WebRTC auth?

3. Are there additional parameters required for **WSS / WebRTC** support?

4. Could `endpoint_identifier_order` be problematic when using Realtime + ODBC?

* * *

## **Goal**

We want to achieve:

- **Browser** using SIP.js → **Asterisk (WSS)** → **FRITZ!Box SIP Trunk** → Outbound Call

- **FRITZ!Box SIP credentials should never be exposed in the frontend**

- WebRTC should run natively via SIP.js

* * *

### **System Info**

```auto
Asterisk 20.6.0
PostgreSQL 16
res_odbc_pgsql / Realtime enabled
SIP.js 0.21.1
Transport WSS: 8089

```

* * *

**Has anyone successfully implemented a similar setup with WebRTC, SIP.js, and Asterisk Realtime?**  
Any hints, configs, or working examples would be extremely appreciated! 🙏

Thx in advance

Halim

---

<div class="post-metadata">

**Author:** ![david551](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@david551](https://community.asterisk.org/u/david551)\
**Post date:** [August 19, 2025, 9:27pm UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/2 "2025-08-19T21:27:06Z")

</div>

> [@halim-kahraman](#):
>
> ❌ Asterisk still returns `401 Unauthorized`

That is correct. The problem doesn’t happen until the actual authentication is attempted, and, although you have cut the log short, you should get 403 not 401.

Why did you hide the nonce? It’s a random number. If the credentials you provided aren’t real, it would make more sense to obscure the response. Both nonce and response are needed to do a brute force attack. Also, you don’t mention the has that includes the nonce.

---

<div class="post-metadata">

**Author:** ![halim-kahraman](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/halim-kahraman/32/9377_2.png) [@halim-kahraman](https://community.asterisk.org/u/halim-kahraman)\
**Post date:** [August 19, 2025, 9:49pm UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/3 "2025-08-19T21:49:22Z")

</div>

> [@david551](#):
>
> That is correct. The problem doesn’t happen until the actual authentication is attempted, and, although you have cut the log short, you should get 403 not 401.
> 
> Why did you hide the nonce? It’s a random number. If the credentials you provided aren’t real, it would make more sense to obscure the response. Both nonce and response are needed to do a brute force attack. Also, you don’t mention the has that includes the nonce.

Hey david, thx for the quick reply.

Here are the pjsip logger:

> == WebSocket connection from ‘85.216.55.145:64326’ for protocol ‘sip’ accepted using version ‘13’  
> \<— Received SIP request (477 bytes) from WSS:85.216.55.145:64326 —\>  
> REGISTER sip:sip.dtec-group.de SIP/2.0  
> Via: SIP/2.0/WSS qsgp51hs5qda.invalid;branch=z9hG4bK6536853  
> To: sip:User1234@sip.dtec-group.de  
> From: sip:User1234@sip.dtec-group.de;tag=o9gc61tqfa  
> CSeq: 2 REGISTER  
> Call-ID: 83036pao165gc58cqhq4  
> Max-Forwards: 70  
> Contact: sip:ugqh98o4@qsgp51hs5qda.invalid;transport=ws;expires=600  
> Allow: ACK,CANCEL,INVITE,MESSAGE,BYE,OPTIONS,INFO,NOTIFY,REFER  
> Supported: outbound, path, gruu  
> User-Agent: SIP.js/0.21.1  
> Content-Length: 0
> 
> \<— Transmitting SIP response (473 bytes) to WSS:85.216.55.145:64326 —\>  
> SIP/2.0 401 Unauthorized  
> Via: SIP/2.0/WSS qsgp51hs5qda.invalid;rport=64326;received=85.216.55.145;branch=z9hG4bK6536853  
> Call-ID: 83036pao165gc58cqhq4  
> From: sip:User1234@sip.dtec-group.de;tag=o9gc61tqfa  
> To: sip:User1234@sip.dtec-group.de;tag=z9hG4bK6536853  
> CSeq: 2 REGISTER  
> WWW-Authenticate: Digest realm=“asterisk”,nonce=“1755640080/c64112855c52d13ae8f5d5e8facd66f4”,opaque=“01e8f3c27b93dc47”,algorithm=MD5,qop=“auth”  
> Server: Asterisk-KCP  
> Content-Length: 0
> 
> \<— Received SIP request (752 bytes) from WSS:85.216.55.145:64326 —\>  
> REGISTER sip:sip.dtec-group.de SIP/2.0  
> Via: SIP/2.0/WSS qsgp51hs5qda.invalid;branch=z9hG4bK158657  
> To: sip:User1234@sip.dtec-group.de  
> From: sip:User1234@sip.dtec-group.de;tag=o9gc61tqfa  
> CSeq: 3 REGISTER  
> Call-ID: 83036pao165gc58cqhq4  
> Max-Forwards: 70  
> Authorization: Digest algorithm=MD5, username=“User1234”, realm=“asterisk”, nonce=“1755640080/c64112855c52d13ae8f5d5e8facd66f4”, uri=“sip:sip.dtec-group.de”, response=“730adc80cdfdb6fbb922d4f6e5259c81”, opaque=“01e8f3c27b93dc47”, qop=auth, cnonce=“hob9r8lsii3g”, nc=00000001  
> Contact: sip:ugqh98o4@qsgp51hs5qda.invalid;transport=ws;expires=600  
> Allow: ACK,CANCEL,INVITE,MESSAGE,BYE,OPTIONS,INFO,NOTIFY,REFER  
> Supported: outbound, path, gruu  
> User-Agent: SIP.js/0.21.1  
> Content-Length: 0
> 
> [Aug 19 23:48:01] NOTICE[1431134]: res\_pjsip/pjsip\_distributor.c:673 log\_failed\_request: Request ‘REGISTER’ from ‘sip:User1234@sip.dtec-group.de’ failed for ‘85.216.55.145:64326’ (callid: 83036pao165gc58cqhq4) - Failed to authenticate  
> \<— Transmitting SIP response (471 bytes) to WSS:85.216.55.145:64326 —\>  
> SIP/2.0 401 Unauthorized  
> Via: SIP/2.0/WSS qsgp51hs5qda.invalid;rport=64326;received=85.216.55.145;branch=z9hG4bK158657  
> Call-ID: 83036pao165gc58cqhq4  
> From: sip:User1234@sip.dtec-group.de;tag=o9gc61tqfa  
> To: sip:User1234@sip.dtec-group.de;tag=z9hG4bK158657  
> CSeq: 3 REGISTER  
> WWW-Authenticate: Digest realm=“asterisk”,nonce=“1755640081/f18fdbe8da123d96967629c6960faa64”,opaque=“294209b83e81648a”,algorithm=MD5,qop=“auth”  
> Server: Asterisk-KCP  
> Content-Length: 0
> 
> == WebSocket connection from ‘85.216.55.145:64326’ closed

The users and pass are for testing

---

<div class="post-metadata">

**Author:** ![david551](https://avatars.discourse-cdn.com/v4/letter/d/3bc359/32.png) [@david551](https://community.asterisk.org/u/david551)\
**Post date:** [August 19, 2025, 10:52pm UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/4 "2025-08-19T22:52:40Z")

</div>

The response looks good, unless nc is being reused, on the nonce has gone stale.

`david@dhcppc4:~$ echo -n ‘User1234:asterisk:Test1234’ | md5sum`  
`65b97a58d1b12c151c6357b9a71b369f -`  
`david@dhcppc4:~$ echo -n ‘REGISTER:sip:sip.dtec-group.de’ | md5sum`  
`4104247aceb215f8815d4e2ba1ec9281 -`  
`david@dhcppc4:~$ echo -n ‘65b97a58d1b12c151c6357b9a71b369f:1755640080/c64112855c52d13ae8f5d5e8facd66f4:00000001:hob9r8lsii3g:auth:4104247aceb215f8815d4e2ba1ec9281’ | md5sum`  
`730adc80cdfdb6fbb922d4f6e5259c81 -`

I’m afraid I don’t know what is wrong.

Could there be invisible characters, like byte order marks?

---

<div class="post-metadata">

**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\
**Post date:** [August 20, 2025, 8:32am UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/5 "2025-08-20T08:32:39Z")

</div>

What is the actual “id” of the endpoint in the database? It needs to match the username.

---

<div class="post-metadata">

**Author:** ![halim-kahraman](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/halim-kahraman/32/9377_2.png) [@halim-kahraman](https://community.asterisk.org/u/halim-kahraman)\
**Post date:** [August 20, 2025, 9:21am UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/6 "2025-08-20T09:21:40Z")

</div>

Thx for testing david, no there are no bytes or invisible charakters, checked it at the database

---

<div class="post-metadata">

**Author:** ![halim-kahraman](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/halim-kahraman/32/9377_2.png) [@halim-kahraman](https://community.asterisk.org/u/halim-kahraman)\
**Post date:** [August 20, 2025, 9:29am UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/7 "2025-08-20T09:29:40Z")

</div>

Hey jcolp,

i’ll put the row of my DB

Sheme of ps\_endpoints

> [{“idx”:0,“id”:“sip-user”,“transport”:“transport-wss”,“aors”:“sip-user”,“auth”:“sip-user”,“context”:“from-internal”,“disallow”:“all”,“allow”:“opus,ulaw,alaw”,“direct\_media”:null,“connected\_line\_method”:null,“direct\_media\_method”:null,“direct\_media\_glare\_mitigation”:null,“disable\_direct\_media\_on\_nat”:null,“dtmf\_mode”:null,“external\_media\_address”:null,“force\_rport”:“yes”,“ice\_support”:null,“identify\_by”:null,“mailboxes”:null,“moh\_suggest”:null,“outbound\_auth”:null,“outbound\_proxy”:null,“rewrite\_contact”:“yes”,“rtp\_ipv6”:null,“rtp\_symmetric”:“yes”,“send\_diversion”:null,“send\_pai”:null,“send\_rpid”:null,“timers\_min\_se”:null,“timers”:null,“timers\_sess\_expires”:null,“callerid”:null,“callerid\_privacy”:null,“callerid\_tag”:null,“100rel”:null,“aggregate\_mwi”:null,“trust\_id\_inbound”:null,“trust\_id\_outbound”:null,“use\_ptime”:null,“use\_avpf”:null,“media\_encryption”:null,“inband\_progress”:null,“call\_group”:null,“pickup\_group”:null,“named\_call\_group”:null,“named\_pickup\_group”:null,“device\_state\_busy\_at”:null,“fax\_detect”:null,“t38\_udptl”:null,“t38\_udptl\_ec”:null,“t38\_udptl\_maxdatagram”:null,“t38\_udptl\_nat”:null,“t38\_udptl\_ipv6”:null,“tone\_zone”:null,“language”:null,“one\_touch\_recording”:null,“record\_on\_feature”:null,“record\_off\_feature”:null,“rtp\_engine”:null,“allow\_transfer”:null,“allow\_subscribe”:null,“sdp\_owner”:null,“sdp\_session”:null,“tos\_audio”:null,“tos\_video”:null,“sub\_min\_expiry”:null,“from\_domain”:null,“from\_user”:“User1234”,“mwi\_from\_user”:null,“dtls\_verify”:null,“dtls\_rekey”:null,“dtls\_cert\_file”:null,“dtls\_private\_key”:null,“dtls\_cipher”:null,“dtls\_ca\_file”:null,“dtls\_ca\_path”:null,“dtls\_setup”:null,“srtp\_tag\_32”:null,“media\_address”:null,“redirect\_method”:null,“set\_var”:null,“cos\_audio”:null,“cos\_video”:null,“message\_context”:null,“force\_avp”:null,“media\_use\_received\_transport”:null,“accountcode”:null,“user\_eq\_phone”:null,“mwi\_subscribe\_replaces\_unsolicited”:null,“deny”:null,“permit”:null,“contact\_deny”:null,“contact\_permit”:null,“contact\_user”:null,“preferred\_codec\_only”:null,“asymmetric\_rtp\_codec”:null,“rtcp\_mux”:null,“allow\_overlap”:null,“refer\_blind\_progress”:null,“notify\_early\_inuse\_ringing”:null,“max\_audio\_streams”:null,“max\_video\_streams”:null,“webrtc”:“yes”,“dtls\_fingerprint”:null,“incoming\_mwi\_mailbox”:null,“uniqueid”:“sip-user”,“type”:“endpoint”}]

Sheme of ps\_auths

> [{“idx”:0,“id”:“sip-user”,“auth\_type”:“userpass”,“nonce\_lifetime”:null,“md5\_cred”:null,“password”:“Test1234”,“realm”:“asterisk”,“username”:“User1234”,“uniqueid”:“sip-user”,“type”:“auth”}]

Sheme of ps\_aors

> [{“idx”:0,“id”:“sip-user”,“contact”:null,“max\_contacts”:2,“remove\_existing”:null,“qualify\_frequency”:null,“authenticate\_qualify”:null,“maximum\_expiration”:null,“minimum\_expiration”:null,“outbound\_proxy”:null,“support\_path”:“yes”,“qualify\_timeout”:null,“voicemail\_extension”:null,“uniqueid”:“sip-user”,“type”:“aor”}]

Here you can see, that i used always for the id’s for testing: “sip-user”

I defined all of the tables type like aor, endpoint or auth

The username is always: User1234 and the Pass: Test1234

i’m confused, why it didn’t match and don’t get the Authentication for REGISTER on Asterisk.

Thx for any help in advance

Halim

---

<div class="post-metadata">

**Author:** ![jcolp](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/jcolp/32/8848_2.png) [@jcolp](https://community.asterisk.org/u/jcolp)\
**Post date:** [August 20, 2025, 9:31am UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/8 "2025-08-20T09:31:06Z")

</div>

> [@halim-kahraman](#):
>
> i’m confused, why it didn’t match and don’t get the Authentication for REGISTER on Asterisk.

Because it would be looking for “User1234” in the database, and not “sip-user”. The “id” needs to match either the From username, or the authentication username.

---

<div class="post-metadata">

**Author:** ![halim-kahraman](https://sea1.discourse-cdn.com/asterisk/user_avatar/community.asterisk.org/halim-kahraman/32/9377_2.png) [@halim-kahraman](https://community.asterisk.org/u/halim-kahraman)\
**Post date:** [August 20, 2025, 9:39am UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/9 "2025-08-20T09:39:10Z")

</div>

Tested and it worked fine! Now im REGISTERED

I spent over 24 hours for finding the solution, thank you so much jcolp 👏

I’ll test now to start a call over WSS. When i found andything, is ok to ask you before spent another 24 hours 😃

Thx

Halim

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/asterisk/original/2X/4/475d0c889911cfb84ac4881ad6df8b523e3f9105.png) [@system](https://community.asterisk.org/u/system)\
**Post date:** [September 19, 2025, 9:39am UTC](https://community.asterisk.org/t/help-pjsip-webrtc-wss-registration-fails-despite-correct-credentials/109725/10 "2025-09-19T09:39:46Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.