Microsoft recently announced a number of important changes to Microsoft Teams Direct Routing and Operator Connect, specifically concerning TLS security and the certification authorities (Root CAs) used between Microsoft Teams and Session Border Controllers (SBCs).
These changes are designed to anticipate the new security requirements of browsers and certification authorities from mid-2026. Preparation is required before the end of February 2026 to avoid any service interruption.
Why is Microsoft making these changes?
SIP signaling between Microsoft Teams and SBCs is based on mutual TLS authentication (mTLS), requiring certificates that comply with strict rules.
Since February 2025, major browsers (Chrome, Firefox) have announced the depreciation of “dual-use” TLS certificates (server + client authentication in the same certificate). From June 2026, only certificates complying with these new rules will remain fully reliable on the browser side.
Microsoft is therefore anticipating these changes by updating the root certification authorities used for the Teams SIP interface.
Key dates to remember
End of February 2026
SBCs must be updated to trust the new Microsoft and DigiCert CA Root.End of March 2026
Microsoft will provide a test SIP endpoint to validate TLS connectivity:- FQDN:
sip.g1.pstnhub.microsoft.com - Port:
5061
(SIP OPTIONS only – no voice traffic)
- FQDN:
From April 2026
Microsoft will start applying the new server-side certificates (no user impact expected if preparation is made).
What this means for your SBC
SBCs must trust certificates issued by the following certification authorities:
- DigiCert Global Root CA
- DigiCert Global Root G2
- DigiCert Global Root G3
- DigiCert TLS ECC P384 Root G5
- DigiCert TLS RSA 4096 Root G5
- Microsoft ECC Root Certificate Authority 2017
- Microsoft RSA Root Certificate Authority 2017
If these CAs are not present in the SBC trust store, TLS negotiation with Microsoft Teams may fail.
What happens if nothing is done?
No immediate impact on Teams users.
Risk ofTLS negotiation failure, which may lead to :- unavailability of Direct routing,
- interruption of incoming and outgoing calls via Teams.
In a nutshell
These changes do not alter the Teams user experience, but they are critical to the continuity of telephone service via Direct Routing.
If you have any doubts about the management of your SBCs or would like to validate your situation, don’t hesitate to contact your partner or your telecom team.
Source
