Asterisk PJSIP TLS Broken After OpenSSL 3 Upgrade? Here's the Fix for 'Wrong Curve' and Every Other Handshake Failure

After upgrading to OpenSSL 3.x, Asterisk PJSIP TLS handshakes fail with a 'wrong curve' error because OpenSSL 3 enforces stricter elliptic curve validation during TLS negotiation. Many SIP hardware devices (Grandstream, Yealink, Polycom) only support limited curves like P-256, causing handshake failures when the server certificate uses a mismatched curve such as P-384. The guide explains the root cause in OpenSSL 3's changed ECDH behavior and provides concrete fixes for Asterisk 18 through 22.