Running the quarterly PCI-DSS compliance review on the telephony stack. The Admin UI under Administration > Voice > Trunks throws a validation warning when applying the mandatory cipher suite list. The form returns TRUNK_CONFIG_CIPHER_MISMATCH_422 upon clicking save. Environment is Genesys Cloud V12.4.1, deployed in the Tokyo region. The audit mandate requires forward secrecy ciphers only, but the dropdown menu only presents standard TLS 1.2 options. Pushing the exact cipher string through the /v2/telephony/providers/edge-trunks endpoint via Postman produces a schema validation failure on the securitySettings.cipherSuites field. It doesn’t match the expected array format.
Does the Edge appliance handle the encryption handshake or does the Genesys Cloud platform manage it? The documentation mentions data residency controls, yet the routing matrix keeps sending the traffic through the US-East cluster. Need to confirm if the SIP signaling path meets the SOC2 Type II logging requirements. The audit log export only captures trunk registration events, not the actual media encryption status.
Configuring the SSO SAML assertion timeout to match the PCI secure flow policy caused another warning. The console just says invalid token duration. We’ve been doing jack all to get the compliance dashboard to turn green. The edge configuration wizard keeps asking for a certificate fingerprint that already sits in the trust store. Is the TCP stream supposed to be masked at the ingress point or does the SIP header handling cover it? The PCI secure flow policy requires the TCP stream to be masked, but the UI only shows SIP header options. You’ll find the masking toggle under the wrong tab.
/v2/telephony/providers/edge-trunks/{trunkId}/security-settings
Expected 200 OK, got 409 CONFLICT.
Payload:
{
“error”: “CIPHER_SUITE_NOT_SUPPORTED_BY_EDGE_FIRMWARE”,
“details”: “Firmware version 4.2.1 does not support ECDHE-RSA-AES256-GCM-SHA384”
}