RFC5922 prohibits wildcard TLS certificates in SIP but sip.api.openai.com uses a wildcard certificate

API Bugs
,
1

Hi,

According to RFC5922, TLS certificate identities in the SIP protocol must not be compared using wildcards.

In section 7.2:

Implementations MUST NOT match any form of wildcard, such as a leading “.” or “*.” with any other DNS label or sequence of labels.

However, it appears that sip.api.openai.com does use a wildcard certificate:

$ openssl s_client -connect sip.api.openai.com:5061 -servername sip.api.openai.com 2>/dev/null | openssl x509 -subject -ext subjectAltName -noout

subject=CN=api.openai.com
X509v3 Subject Alternative Name:
    DNS:api.openai.com, DNS:*.api.openai.com

I first came across this issue when trying to integrate the realtime API into an existing PBX system called 3CX. The certificate fails to validate. 3CX say they don’t support wildcards because of the RFC.

As a workaround, I ended up writing an external SIP proxy that does the certificate validation with wildcards. 3CX --[SIP UDP]--> Proxy --[SIP TLS]--> OpenAI SIP Endpoint

It would be nice if sip.api.openai.com used a non-wildcard certificate so I would be able to integrate 3CX with the realtime API directly. I’m sure there are other SIP implementations out there that expect non-wildcard certificates.

Thank you!

1 Like