Re: TLS issue

Backing out on this a little a few points:

sni is "Server Name Indicator", and is used for matching names presented in
the certificate (either in the name itself of subject alternate names).

Next, remember that TLS transport doesn't by default re-use TLS sessions,
even for the same dialog.  You say "incoming calls work fine from this
provider, until we send a BYE", but the "call" contains the entire dialog.
If the BYE fails, then the call fails. So, the question is:  Is the tls
handshake failing whenever your Kamailio proxy attempts a handshake with
that server, and if so, who's rejecting it? (check your packet capture to
see the TLS negotiation failure).  From this it looks like it's when you
send a request to `sip.foobar.com`, where you're the client.

Next, looking at your TLS config, you have two sections named
`[client:any]`.  Which one should apply?  Looking at the examples in the
tls module code (
https://github.com/kamailio/kamailio/blob/master/src/modules/tls/tls.cfg)
each section would be like `client:ip_address:port`.  I don't know if
`client:hostname:port` would also work or not, however it looks like you
have two conflicting sections, and my guess would be that your voxbone
section is clobbering the foobar section.

You might also want to use `openssl s_channel` to test the handshake alone,
as it's probably faster than testing with actual calls.

On Mon, Jun 22, 2026 at 5:04 PM Martin Nyström via sr-users <
[email protected]> wrote:

> It is confirmed in their specification that they require TLS 1.2.
>
> A hint in all this, is that incoming calls work fine from this provider,
> until we send a BYE. Then it fails with the same error.
>
> We are running 6.1.2 by the way.
>
> /M
> *From: *Fred Posner <[email protected]>
> *Date: *Monday, 22 June 2026 at 23:32
> *To: *Kamailio (SER) - Users Mailing List <[email protected]>
> *Cc: *Martin Nyström <[email protected]>
> *Subject: *Re: [SR-Users] TLS issue
>
> CAUTION: This email originated from outside the organization. Do not click
> links or open attachments unless you recognize the sender and know the
> content is safe.
>
>
>
> Have you made sure they are using TLS 1.2 or higher?
>
>
> Regards,
>
> Fred Posner
>
>
>
>
>
> > On Jun 22, 2026, at 4:56 PM, Martin Nyström via sr-users <
> [email protected]> wrote:
> >
> > ERROR: tls [tls_util.h:56]: tls_err_ret(): TLS
> connect:error:0A000413:SSL routines::sslv3 alert unsupported certificate
> (sni: unknown)
> >
>
> __________________________________________________________
> Kamailio - Users Mailing List - Non Commercial Discussions --
> [email protected]
> To unsubscribe send an email to [email protected]
> Important: keep the mailing list in the recipients, do not reply only to
> the sender!
>

__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions -- [email protected]
To unsubscribe send an email to [email protected]
Important: keep the mailing list in the recipients, do not reply only to the sender!