# Debugging TLS problems

This page reorganizes the operational steps for **Debugging TLS problems**.

There is a problem with CentOS 9 and TLS with Asterisk. These tools may help to identify the issue

List all the ciphers available

```
openssl ciphers -v
```

Check the ciphers available on a SSL server

```
openssl s_client -connect pbx.mirtapbx.com:5061 -cipher ALL
```

or using nmap

```
nmap --script ssl-enum-ciphers -p 5061 pbx.mirtapbx.com
```

Check the protocols available on SSL server

```
testssl.sh pbx.mirtapbx.com:5081
```

To check for the ciphers available on a client, dump the packets with tshark

```
tshark -i eth0 -w /var/www/html/tls.pcap -s 1500 -f 'host 176.206.10.252 and port 5061'
```

And then process in wireshark using the ssl.handshake filter. Look for the Secure Socket Layer section

Enable LEGACY support

```
update-crypto-policies --set LEGACY
```

Check support level

```
update-crypto-policies --show
```

In pjsip.conf now you can use

```
method=tlsv1_2
cipher=DEFAULT,@SECLEVEL=1
```

## Current Verification

After applying the change, verify the related MiRTA PBX page, the Asterisk logs, and the relevant Status menu entry. Recheck tenant selection before testing tenant-specific behavior.