Phones were not registering with zero log entries — two root causes:
1. Self-signed cert lacked Subject Alternative Names (SANs). Modern TLS
clients (iOS/Android SIP apps) require SANs and ignore CN-only certs,
causing silent TLS handshake rejection. Cert generation now includes
SANs (DNS + IP), and existing certs without SANs are auto-regenerated.
2. Logger only captured notice/warning/error — TLS handshake failures
are logged at the security level. Added security to console logging.
Also added:
- Startup check verifying port 5061 is actually bound
- TLS/cert diagnostics in vpn-diagnostics (SAN check, port check,
self-signed warning with guidance for phone configuration)
https://claude.ai/code/session_01Vm6NLaQuzM4VosAotqS1q8
Claude
7ffa5f6e6f