Asterisk supports STIR/SHAKEN natively — the rewritten res_stir_shaken module (18.22.0, 20.7.0, 21.2.0) signs outbound calls at A, B, or C attestation and verifies inbound ones. But a signature carriers trust requires your own SHAKEN SP certificate, and only qualifying voice service providers can obtain one. For nearly every self-hosted PBX, the practical path is a carrier signing at A-level.
“Can Asterisk do STIR/SHAKEN?” is really two questions: can the software build a signed Identity header (yes, in recent versions), and will any verifier trust that signature (not without credentials most PBX operators cannot get). This guide separates the two.
What Asterisk actually supports
Asterisk’s first attempt shipped in 16.15.0: a per-endpoint PJSIP stir_shaken option with outbound INVITE signing and inbound verification. The official deployment docs now describe that original code as “only partially functional and not interoperable with other implementations” — on an old LTS branch, the module you have is effectively decorative.
The working implementation is the complete rewrite (the “Stir/Shaken Refactor”) that landed in 18.22.0, 20.7.0, and 21.2.0 in early 2024, shipped explicitly to fix interoperability, RFC compliance, and performance. Two migration facts matter: stir_shaken.conf changed significantly, so pre-refactor configs must be rewritten, and the module now requires the libjwt v1.15.3 dev package (or building with --with-libjwt-bundled).
Post-refactor, res_stir_shaken covers both directions:
| Direction | What the module does |
|---|---|
| Outbound (attestation) | Creates and signs SIP Identity headers at Full (A), Partial (B), or Gateway (C) level |
| Inbound (verification) | Certificate chain verification, CRL checking, signature validation, timestamp validation |
Configuration lives in stir_shaken.conf: an attestation object (private key, public cert URL, attestation level), per-number tn objects keyed by canonicalized numbers with a country code, a verification object (CA/CRL files, certificate caching), and profile objects attached to chan_pjsip endpoints via stir_shaken_profile.
The docs are equally candid about limits: Asterisk does not validate the destination TN, cannot verify that the Service Provider Code in a certificate actually has authority over the calling number, and does not do real-time CRL retrieval from certificate extensions. The heavy trust decisions in how STIR/SHAKEN works happen in the certificate ecosystem, not in your dialplan.
Why you almost certainly cannot self-sign
Here is the part the tutorials skip. The module’s attestation config wants a private key and a certificate URL — but the certificate must come from an approved STI Certification Authority, and an STI-CA only issues one against an SPC token from the STI Policy Administrator (iconectiv). The STI-GA’s token access policy sets the gate:
- a current FCC Form 499A on file (or proof of payment of the annual RespOrg fee);
- an assigned Operating Company Number (OCN) or a Resp Org ID;
- FCC certification of STIR/SHAKEN implementation or Robocall Mitigation Program compliance, listed in the FCC database — or status as a non-carrier RespOrg with direct toll-free number access.
iconectiv operationalizes this hard: the OCN must be eligible for numbering-resource assignments and proves direct access to numbers from NANPA and the Pooling Administrator, the STI-PA validates your 499A filing status with the FCC, and annual fees are calculated from 499A revenue lines.
A call center running FreePBX under a dialer holds none of that — no numbering-eligible OCN, no 499A as a telecommunications provider, no RMD certification as a voice service provider. Call centers generally cannot meet the STI-PA criteria (the exception is an operation that also runs as a carrier in its own right), so only an upstream carrier can sign the calls.
The FCC has also closed the borrow-a-certificate loophole. Under the Eighth Report and Order (FCC 24-120, adopted November 2024), every provider with a STIR/SHAKEN obligation must obtain its own SPC token and sign with its own certificate “whether directly or through a third party” — relying on someone else’s token or certificate is expressly prohibited, and even outsourced signing leaves the attestation-level decision with the originating provider.
What B-attestation means for your traffic
When a middleman signs your calls, the level depends on what it can verify. Per the ATIS definitions the FCC quotes, A-level requires a verified association between you and the calling number; B-level means the provider can identify you as a customer but has not verified your right to that caller ID. Analytics engines treat partial (B) attestation as a lower-trust signal; no carrier publishes a specific answer-rate gap. The full comparison is in A-level vs. B-level attestation; the reseller-chain version is covered in reseller vs. carrier attestation.
The architectures that actually work
Once self-signing is off the table, two useful patterns remain for a self-hosted Asterisk or FreePBX deployment.
1. The carrier signs everything (recommended)
Your PBX does nothing STIR/SHAKEN-related outbound — no attestation object, no certificates on disk. Calls leave your trunk unsigned and the carrier’s switch attests them on entry. When the carrier holds its own SP certificate and has verified your DIDs, that signature is A-level — the entity with the FCC filings, the OCN, and the number relationships makes the attestation claim, which is how the ecosystem was designed.
Bias disclosed: this is what SIPNEX does. We are an FCC-licensed carrier with our own STIR/SHAKEN SP certificate, signing outbound calls directly at A-level on verified DIDs — details on our STIR/SHAKEN compliance page. The evaluation question for any carrier is the same: do they sign with their own certificate, or does someone upstream sign for them?
2. Asterisk as an inbound verifier
The verification side of res_stir_shaken needs no SPC token — verification works from the signer’s public certificate and a configured CA trust list. On an inbound trunk, that lets your dialplan see whether a call arrived signed and whether the signature held up, useful for screening or logging on DIDs you control — with the documented caveat that Asterisk cannot confirm the signer’s authority over the specific calling number.
FreePBX and VICIdial specifics
FreePBX has no native STIR/SHAKEN GUI module. Sangoma staff said it plainly on the official forum in May 2022 — “FreePBX doesn’t have support for it, and the Asterisk module itself needs further work” — and as of Sangoma’s published documentation nothing native has replaced that answer. What the docs portal carries instead is community-contributed guides for wiring third-party signing services (TransNexus ClearIP, Sansay NSS, TILTX) in front of FreePBX: an external service signs; FreePBX itself never does.
VICIdial is the same story. Its documented STIR/SHAKEN support is the official TILTX integration (svn/trunk 3449+): an AGI script runs before each outbound carrier dial and tags the call with X-TILTX-ID, Identity, and CAID headers for TILTX’s service. Nothing in VICIdial’s documentation gives the dialer a certificate or signing role — the headers are tags for TILTX’s service. If your dialer trouble is broader than signing, start with the VICIdial troubleshooting guide.
How to check what your calls get today
Ask your carrier, in writing: who signs your outbound calls, with whose certificate, at what attestation level. A carrier signing with its own SP certificate answers in one sentence; vague talk of “upstream partners” usually means B or C attestation applied somewhere you can’t see.
Then test. Point an inbound DID you control at your Asterisk box with verification enabled and call it from your own outbound trunk — the Identity header (or its absence) and the verification result show what the far end sees. If your traffic is drawing “Network Blocked” responses instead, that is a different diagnosis path: see SIP code 603.
Frequently asked questions
Can Asterisk sign calls with STIR/SHAKEN on its own?
Technically yes, practically no. The refactored res_stir_shaken module can create and sign Identity headers at A, B, or C attestation — but a signature only counts when it chains to an SP certificate issued against an STI-PA SPC token, and those go only to qualifying voice service providers. Without that credential the module has nothing valid to sign with, which is why self-hosted deployments rely on carrier-side signing.
Which Asterisk versions have working STIR/SHAKEN support?
Use 18.22.0, 20.7.0, or 21.2.0 and later — the versions carrying the complete rewrite. The original implementation from 16.15.0 is described in Asterisk’s own deployment docs as only partially functional and not interoperable with other implementations. The refactor also changed stir_shaken.conf significantly and added a build requirement: libjwt v1.15.3 dev packages, or configuring with —with-libjwt-bundled.
Does FreePBX add STIR/SHAKEN signing on top of Asterisk?
No. FreePBX has no native STIR/SHAKEN module — Sangoma staff confirmed this on the official forum in May 2022, and as of Sangoma’s published documentation that has not changed. The guides on Sangoma’s docs portal are community-contributed walkthroughs for external signing services like TransNexus ClearIP, Sansay NSS, and TILTX, where a third-party service or SIP proxy applies the signature before the call reaches the carrier.
Why can’t my Asterisk call center get its own SHAKEN certificate?
Because the STI-PA gate is built for carriers. An SPC token requires a current FCC Form 499A filing (or RespOrg fee payment), an assigned OCN or Resp Org ID, and FCC certification listed in the Robocall Mitigation Database. A call center generally holds none of those — it buys numbers from a carrier rather than receiving them from NANPA — so only an upstream provider that meets the criteria can sign its calls.
What attestation level do calls from a self-hosted Asterisk box get?
Whatever the signing carrier assigns — the PBX does not decide. A carrier with a verified association between you and the calling number can attest A-level; one that can only identify you as a customer attests B. Ask in writing which level applies to your DIDs, and verify with a test call to a number you control.
SIPNEX is an FCC-licensed carrier with its own STIR/SHAKEN SP certificate — outbound calls on verified DIDs are signed directly at A-level, and we are registered in the Robocall Mitigation Database. If your self-hosted PBX or dialer is stuck at B-attestation behind a middleman, see how our STIR/SHAKEN signing works or talk to us about your trunks.
Keep reading.
The carrier built by operators, for operators.
FCC-licensed carrier with its own STIR/SHAKEN SP certificate. Operator-owned. SIP trunks built for operators who dial at volume.