Use the application's actual target
Record the SIP domain, configured transport, explicit port and resolver. Then inspect the NAPTR/SRV/address path the client is expected to use. A successful lookup of an unrelated web hostname proves little about the phone's SIP service. For TLS, distinguish the address connected to from the identity the client must validate. SIP service discovery can select a target host while domain certificate rules still matter. Compare the endpoint's implementation and provider requirements rather than accepting any certificate presented by a reachable server.
A bounded certificate inspection
The OpenSSL example connects to a documentation hostname on the conventional SIP TLS port, sends SNI and requests hostname verification. Replace both names and the port with the authorized service. It tests a direct TLS connection, not WSS path upgrades or a complete SIP registration. Read verification errors, certificate validity and chain information. A successful handshake with verification errors is not a clean validation result; the verification-return-error option makes that distinction explicit. Local trust stores can differ from the phone's trust store.
openssl s_client -connect sip.example.net:5061 -servername sip.example.net -verify_hostname sip.example.net -verify_return_errorResolve the actual mismatch
Check device time, intermediate certificates, intended identity and supported protocol versions. If DNS points to a new target, verify that target serves the correct certificate and SIP service. Do not disable validation to conceal a renewal or identity error. Repeat the test from the affected network and from the endpoint where supported. Keep the result and time with the incident, then verify registration and calling separately. DNS and TLS success narrow the investigation; they do not prove dialplan or media health.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.