Polycom SoundPoint TLS configuration

[seanthegeek]

I have an Asterisk (16.16.1 from the Debian 11 Bullseye repository) chan_pjsip TLS transport configured with Let’s Encrypt certificates.It is working great for softphones. I’d like to get TLS working on my Poycom SoundPoint 321 running UC 4.0.15 (old, I know) if I can, but I’m running into problems. I’ve even tried explicitly setting the protocol and Certificate Authorities (CAs), with no success.

Any idea what I’m doing wrong?

Polycom logs:

|MakeTlsConnection: SSL_connect failed 'error:140840FF:SSL routines:ssl3_connect:unknown state' err -1
Unable to get Peer Certificate.
Server Certificate SAN or CN validation failed
MakeTlsConnection: connection failed error -1

Asterisk transport configuration:

[tls]                                                                                                                                
type=transport                                                                                                                               
protocol=tls                                                                                                                                                                                                                                 
ca_list_file=/etc/ssl/certs/ca-certificates.crt                                                                                              
cert_file=/etc/asterisk/keys/pbx.crt                                                                                                 
priv_key_file=/etc/asterisk/keys/pbx.key                                                                                             
method=tlsv1_2
verify_client=no                                                                                                                             
verify_server=yes

Polycom SIP line configuration

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>                                                                                                                                                                               
<polycomConfig xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="polycomConfig.xsd">                      
  <call call.callsPerLineKey="24">                                                                                                           
  </call>                                                                                                                                    
  <reg                                                                                                                                       
  reg.1.server.1.address="pbx.example.net"                                                                                                  
  reg.1.server.1.port="5061"                                                                                                                 
  reg.1.server.1.transport="TLS"                                                                                                         
  reg.1.address="104"                                                                                                                        
  reg.1.auth.userId="104"                                                                                                                    
  reg.1.auth.password="redacted"                                                                                     
  reg.1.srtp.require="1"                                                                                                                     
  reg.1.label="104"                                                                                                                          
  reg.1.lineKeys="1"                                                                                                                         
  reg.1.displayName="Example Phone"                                                                                                        
  />                                                                                                                                         
</polycomConfig>

Polycom TLS configuration

<polycomConfig xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="polycomConfig.xsd">
<sec>
    <sec.TLS>
        <sec.TLS.customCaCert 
        sec.TLS.customCaCert.1="MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygch77ct984kIxuPOZXoHj3dcKi"
        sec.TLS.customCaCert.2="MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAwWhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3MgRW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cPR5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdxsxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8ZutmNHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxgZ3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaAFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcwAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRwOi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQBgt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6WPTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wlikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQzCkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BImlJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1OyK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90IdshCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6ZvMldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqXnLRbwHOoq7hHwg=="
        />
        <sec.TLS.protocol 
        sec.TLS.protocol.sip="TLSv1_2"
        />
    </sec.TLS>
</sec>
</polycomConfig>