Hi
I decided just to post about an issue I just resolved with setting up a SIP BYOC trunk from Genesys Cloud to my on premise Audiocodes SBC using TLS. Possibly it helps someone else in future.
After creating public DNS records and getting Digicert certificates for the SBC, I kept running into issues where I was able to terminate calls on Genesys, but outbound calls from Genesys to my SBC would fail to establish when using TLS. Looking at the SBC logs I would see "tlsv1 alert unknown ca" followed by a tearing down of the TLS connection. Using debug recording and wireshark I was able to determine that Genesys was sending the alert in reply to the SBC sending its certificate.
The reason for this is that you must set up the Audiocodes TLS context to send the entire certificate chain to Genesys during the handshake. Just concatenate the server and intermediate certificate(s) in the same PEM file and upload to the SBC along with your private key. You can also add then root CA certificate, although it should work without. Bottom line, make sure that Genesys who only has the root, is given all the certificates it needs to validate the entire chain to the root.
Also remember to add the relevant CA certificates to the TLS context under "Trusted Root Certificates" so that the SBC can validate the certificates Genesys sends assuming of course that you have enabled strict validation.
Depending on the use case these could be Digicert or AWS certs. Refer to TLS trunk transport protocol specification for BYOC Cloud - Genesys Cloud Resource Center
#Telephony
------------------------------
Craig Gibson
Senior Systems Specialist
------------------------------