Genesys recently announced an upcoming deprecation for BYOC Cloud SIP TLS ciphers. This discussion will be for sharing more information and allowing users to ask questions regarding this deprecation. Deprecation: BYOC Cloud SIP TLS ciphers
In summary, Genesys is planning on removing two existing TLS ciphers from use for BYOC Cloud SIP trunks:
- TLS_RSA_WITH_AES_256_CBC_SHA256, also referred to as AES256-SHA256
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, also referred to as ECDHE-RSA-AES256-SHA384
These ciphers will be removed on a future date. Genesys can track the usage of these ciphers and will communicate with customers using these ciphers to minimize impact.
More details about BYO Cloud TLS capabilities are listed on this page: TLS trunk transport protocol specification
Remote SIP Endpoints
In this discussion a "remote SIP endpoint" represents a device external from the Genesys platform that communicates with Genesys Cloud using BYOC Cloud with the SIP protocol. This device is usually controlled and managed by telephony or network administrators or one of their partners, such as a carrier or service provider. These devices are not controlled or managed within Genesys Cloud. These devices determine the TLS ciphers and priority used for inbound calls into Genesys Cloud.
BYOC Cloud SIP Endpoints
In this discussion, a "BYOC Cloud SIP Endpoint" represents the public SIP endpoints for Genesys Cloud listed on this page: BYOC Cloud Public SIP IP Addresses. These devices are controlled and managed by Genesys and there is no Genesys Cloud configuration required for this deprecation. These devices determine the TLS cipher priority used for outbound calls from Genesys Cloud. Genesys has already lowered the priority of the ciphers that will be deprecated, so they will only be selected if they are the only available ciphers.
GC External Trunk
In this discussion the "GC External Trunk" represents the Genesys Cloud SIP trunk configuration for the BYOC Cloud trunk. This is the Genesys Cloud configuration where the details for the communication between the BYOC Cloud SIP Endpoints and the remote SIP endpoints is defined.
Nothing needs to be changed in your Genesys Cloud configuration - the use of these ciphers is determined by your remote SIP endpoint; most likely a Session Border Controller (SBC), SIP Trunk, or carrier configuration, or carrier device.
It is beneficial for all BYOC Cloud customers to remove these ciphers from their own remote configuration in advance to help the reporting and tracking of the usage of these ciphers.
Inbound Calls (Carrier or SBC to Genesys Cloud)
When secure external inbound calls are dialed and sent to Genesys Cloud using BYOC Cloud the "remote SIP endpoint" starts a TLS negotiation with the Genesys Cloud BYOC Cloud SIP endpoints. During this negotiation, the remote SIP endpoint provides a prioritized list of supported ciphers. The Genesys Cloud BYOC Cloud SIP endpoints will choose the highest prioritized cipher that the remote SIP endpoint offers that Genesys Cloud also supports. If one of the ciphers to be deprecated has the highest priority it will be selected and used. Genesys cannot deprioritize those ciphers, that must be managed by the remote SIP endpoint.
Outbound Calls (Genesys Cloud to Carrier or SBC)
When secure external outbound calls are dialed from Genesys Cloud and sent to your carrier or telephony platform using BYOC Cloud the "BYOC Cloud SIP endpoints" start a TLS negotiation with the remote SIP endpoint. During this negotiation, the BYOC Cloud SIP endpoints provides a prioritized list of supported ciphers; the ciphers that are being deprecated are included, but they have the lowest priority. The remote SIP endpoint will choose the highest prioritized cipher that the BYOC Cloud SIP endpoints offers that the remote SIP endpoint also supports. If the remote SIP endpoint only supports the ciphers to be deprecated then one will be used.
When Genesys reports on cipher usage, any inbound call that is using a cipher to be deprecated indicates that the remote SIP endpoint is prioritizing one of those ciphers. Any outbound calls that is using a cipher to be deprecated indicates that the remote SIP endpoint only supports one of those ciphers.
How to determine the TLS cipher being used
The best way to review the cipher selection is to review a packet capture of the SIP communication. Although with TLS trunks the SIP communication will be encrypted and not visible in the capture, the TLS handshake process provides details that can be derived from the capture. It is important to look at both inbound and outbound calls separately, as negotiating different ciphers for each call direction is common.
Locate the TLS Handshake Client Hello request message, expand the Client Hello and the nested Cipher Suites list. This is the prioritized list the client sends to the server list all of the client's supported ciphers and the order it prefers for them to be selected (higher in list is higher priority). The below list is the prioritized list that the Genesys Cloud BYOC SIP endpoints send on outbound calls. Note that the two ciphers being deprecated (0x003d) and (0xc028) receive the lowest priority; they will only be chosen if the server does not support any of the other ciphers.
#Telephony
------------------------------
Phil Whitener
Genesys Employee
------------------------------