11 · TLS, certificates, SIP
A certificate can be valid and still be the wrong name.
The name Teams checks is the FQDN you configured on the gateway. A wildcard is acceptable when it follows RFC 2818. A certificate for www.contoso.com does not cover sbc1.contoso.com.
If you add a sip subdomain, verify that domain in the tenant before you pair it. DNS must resolve publicly. Split-horizon DNS that only works inside the office will not help Microsoft’s proxies.
The certificate, public DNS, and the paired FQDN must agree. Wildcards only help when RFC 2818 says they match.
The certificate name, the DNS name, and the paired FQDN are the same name.
If it fails: TLS fails with a name mismatch and someone restarts the SBC instead.
A colleague reports: The handshake dies before OPTIONS. Where do you start?
The handshake dies before OPTIONS. Upgrade firmware and offer TLS 1.2 or newer toward the proxies. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
Which description of Certificate SAN is accurate?
The name on the SBC certificate must match the FQDN you paired. Wildcards are allowed when they follow RFC 2818. A certificate that is valid for the website and not for sbc1.contoso.com still fails. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
A colleague reports: TLS fails with a name mismatch and someone restarts the SBC. Where do you start?
TLS fails with a name mismatch and someone restarts the SBC. Issue the certificate for the paired name. Include the chain. Source: https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan accessed 2026-10-14.
Around the call: compliance recording, workforce management, emergency location, analytics, CRM screen pop, and an agent with a human escape. Each one has its own failure.
TLS fails with a name mismatch and someone restarts the SBC instead.
Cisco CUBE is one of the SBC families named in this lab’s certification lesson. A certified release can be the Direct Routing SBC between Unified CM and Teams.
The tenant still needs a verified domain on the SBC FQDN, and the user still needs Teams Phone. The studio translator does not open a live AXL session. Confirm the current certified release before you build.
Teams Phone and Webex Calling are separate clouds. This lab does not describe a feature that registers a Webex Calling user into a Teams tenant.
A number move is usually a carrier port, a certified SBC, or a meetings interop product. Confirm before relying.
Unified CCE stays the ACD until you migrate it. Microsoft’s contact-center articles name Connect, Extend, and Unify. They do not name a UCCE connector in the notes this lab cites.
Voice into Teams is still Direct Routing or Operator Connect. The routing script stays on the contact-center product you bought. Confirm the vendor’s current model. Source: https://learn.microsoft.com/en-us/microsoftteams/teams-contact-center.
Copilot Studio, Azure Communication Services, and Graph are later tracks in this lab. Treat any uncited limit as confirm before relying.
Opened 2026-10. A row marked confirm did not open. Wikipedia is background. The Teams blog row is the community index.
