Asterisk PJSIP TLS Broken After OpenSSL 3 Upgrade? Here's the Fix for 'Wrong Curve' and Every Other Handshake Failure

The Problem Nobody Warned You About You upgraded your server — maybe a routine apt upgrade , maybe a Docker image rebuild, maybe a distro migration. Asterisk was humming along, PJSIP endpoints connecting over TLS on port 5061 like they have for years. Then suddenly: WARNING[12345]: pjproject: SSL SSL_ERROR_SSL (Handshake): err: <error:0A00017A:SSL routines::wrong curve> Your phones stop registering. Your ATAs go offline. Your SIP trunks drop. Disabling TLS brings everything back, but that's not a solution — it's a surrender. This is the OpenSSL 3.x ECDH curve compatibility problem, and it's hit a lot of Asterisk administrators who didn't see it coming. The error message is cryptic, the Asterisk logs don't tell you what curve is "wrong," and the fix requires understanding a change that happened deep inside OpenSSL's TLS negotiation logic. This guide covers exactly what changed, why it breaks specific devices, and the concrete steps to fix it — whether you're running Asterisk 18, 20, 21,