After some more debugging, I found that the issue is related to a specific SSL message which occurs specifically when the softphone is exited (Completely exited, not account deactivation). I have traced the issue using wireshark and the packet below is triggering the error;
It does not seem that issue is service impacting. The PJSIP traces I provided before seem to be network related. However Id like to confirm if the issue can be resolved or if these messages can be safely ignored.
I am using Let’s Encrypt certificates. I have read and observed that these are not trusted by older phone models. I thought this may be related and I replaced the certificate with one issued by a commercial CA.
Same behaviour was observed. Issue does not seem to be related.
You are running into a problem numerous people are now running into. The SSL/TLS standards changed in 2020 every vendor has been deprecating and removed anything that is TLS1.0 or less. Certain encryption algorithms, ciphers, etc. where removed as they were found to be lax and vulnerabilities were exposed in them. Basically anything TLS1.0 in considered insecure and both TLS1.1 and 1.0 are considered EOL for the last couple years.
They have also stepped up the version releases. TLS 1.2 was released in 2008, TLS1.3 was released in 2018 but they have said versions will not have 10 year gaps like this again.
So what is happening with you is that you are now getting certs that have couple algorithms removed and updated ciphers. Your devices will now need to support TLS1.2 and if they are out of date/EOL old devices that aren’t getting updates. They are done using TLS in any modern format.
Like I said, you’re not the only one. I’m seeing numerous people posting/talking about their 10 year old phones no longer working with TLS after a new cert/renewal was done.
Hello, thanks for the info provided. At the moment I am forcing the use of TLS1.2, Im not forcing the user of any specific ciphers though. Also, I am connecting via soft phone, specifically MicroSip 3.20 which is very “modern”.
Are you aware of a configuration or device combination which is not effected by these errors? At the moment I have around 300 extensions, and while I don’t have any operational issues, the cli is flooded with these errors. Im looking to scale tenfold and I’d like to make sure that nothing is wrong with my setup.
In the meantime, I will test with other softphones/deskphones and will update this post accordingly.