Question

You configured a secure SIP trunk between Cisco Unified Communications Manager (CUCM) and a Cisco Expressway-C using TLS. Calls over the trunk fail to establish, and the CUCM SDL trace shows a TLS handshake failure with the reason 'certificate verify failed'. The SIP Trunk Security Profile on CUCM is set to Encrypted with 'X.509 Subject Name' populated. Both nodes' certificates are signed by the same enterprise CA, which is loaded into each server's trust store. What is the MOST likely cause of the failure?

Accepted Answer

The X.509 Subject Name configured in the SIP Trunk Security Profile does not match the CN or a SAN entry in the Expressway-C certificate presented during the handshake

Answer

The enterprise CA certificate must be uploaded to the CallManager-trust store instead of the tomcat-trust store on CUCM

Answer

The SIP trunk incoming port on CUCM is set to 5060 instead of the secure port 5061

Answer

CUCM is not running in mixed mode, so TLS SIP trunks cannot be established