11 · TLS, certificates, SIP
SIP never starts if TLS fails. Dial-plan debates can wait.
Issue a certificate whose subject or SAN contains the SBC FQDN, from a CA in the Microsoft trusted root program, with server authentication EKU. Generate the CSR on the SBC. A private lab CA is how you learn the failure, not how you run production.
TLS 1.2 or newer toward the proxies. TLS 1.0 is not a compatible offer. Include the chain. An incomplete chain looks like a mysterious timeout.
The SBC certificate must match the paired name, come from a trusted public CA, and speak TLS 1.2 or newer.
Public CA, SAN matches the paired FQDN, server EKU, TLS 1.2 or newer.
If it fails: The chain is missing and the handshake times out.
Which description of SRTP is accurate?
The media encryption Direct Routing uses. Signaling is TLS. A successful INVITE with plaintext RTP is not the design. One-way audio is often a port problem, not a missing SRTP checkbox you invent. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
A colleague reports: The SBC offers RTP/AVP only and the call fails or is unsupported. Where do you start?
The SBC offers RTP/AVP only and the call fails or is unsupported. Allow the UDP media range. Do not strip SRTP on the SBC. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
Which description of TLS 1.2 is accurate?
Direct Routing signaling expects modern TLS. TLS 1.0 is not a compatible offer. Old SBC firmware is a certificate problem and a protocol problem at once. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
Around the call: compliance recording, workforce management, emergency location, analytics, CRM screen pop, and an agent with a human escape. Each one has its own failure.
The chain is missing and the handshake times out.
Cisco CUBE is one of the SBC families named in this lab’s certification lesson. A certified release can be the Direct Routing SBC between Unified CM and Teams.
The tenant still needs a verified domain on the SBC FQDN, and the user still needs Teams Phone. The studio translator does not open a live AXL session. Confirm the current certified release before you build.
Teams Phone and Webex Calling are separate clouds. This lab does not describe a feature that registers a Webex Calling user into a Teams tenant.
A number move is usually a carrier port, a certified SBC, or a meetings interop product. Confirm before relying.
Unified CCE stays the ACD until you migrate it. Microsoft’s contact-center articles name Connect, Extend, and Unify. They do not name a UCCE connector in the notes this lab cites.
Voice into Teams is still Direct Routing or Operator Connect. The routing script stays on the contact-center product you bought. Confirm the vendor’s current model. Source: https://learn.microsoft.com/en-us/microsoftteams/teams-contact-center.
Copilot Studio, Azure Communication Services, and Graph are later tracks in this lab. Treat any uncited limit as confirm before relying.
Opened 2026-10. A row marked confirm did not open. Wikipedia is background. The Teams blog row is the community index.
