A challenge can be normal
A server can respond with 401 and WWW-Authenticate; a proxy can use 407 and Proxy-Authenticate. The client then retries with the corresponding authorization header. The digest is computed from credentials and challenge/request information rather than sending the password as a plain header value. This does not make an unencrypted capture harmless. Digest exchanges can expose identities and support password-guessing attacks, particularly with weak secrets or legacy algorithms. Protect signaling transport and capture files as well as the credential itself.
Check the negotiated inputs
Compare realm, nonce, algorithm, username and the URI used in the digest calculation. A stale nonce can legitimately trigger a fresh challenge. Repeated challenges with no progress may indicate mismatched credentials, an unsupported algorithm or an authorization identity different from the extension number. RFC 8760 adds stronger digest algorithms, including SHA-256 and SHA-512/256. Endpoint and registrar support must align; enabling a stronger algorithm only on one side can interrupt registration. Do not describe MD5-era interoperability as a reason to accept short passwords or disable TLS validation.
Separate authentication from permission
A successful digest response establishes a credential relationship; it does not authorize every destination or feature. A later 403 can reflect policy, tenant assignment or destination restrictions. Check server-side reasons without repeatedly changing a working password. Rotate a suspected exposed secret, update its authorized endpoints and inspect registration and call history. When sharing evidence, remove Authorization headers and secrets entirely. Keep response codes, realm where appropriate, algorithm and anonymized timing so the failure remains diagnosable.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.