Azure Bot not joining meeting - Server Internal Error. DiagCode: 500#1203002.@

Question

This problem has been bothering me for about two weeks and I haven’t found a solution yet. I’d really appreciate your help.&nbsp;Environment Setup1.Development Tool: Visual Studio 2022&nbsp;2.Deployment: The service is hosted on AWS. In AWS Networking, both TCP and UDP port 14217 are opened.The operating system is Windows Server 2022, and the firewall has been disabled temporarily for testing.&nbsp;3.Certificate: A wildcard SSL certificate issued by Let’s Encrypt (CN = *.bottest.com, RSA-based) has been installed under LocalMachine\My certificate store.&nbsp;4.Reverse Proxy: Both HTTPS and TCP traffic are forwarded through Nginx.http {&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp; listen&nbsp; &nbsp; &nbsp; &nbsp;80;&nbsp; &nbsp; &nbsp; &nbsp; server_name&nbsp; localhost;&nbsp; &nbsp; }&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp; listen 443 ssl;&nbsp; &nbsp; &nbsp; &nbsp; server_name signaling.bottest.com;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate&nbsp; &nbsp; &nbsp;fullchain.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate_key privkey.pem;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ssl_protocols&nbsp; &nbsp; &nbsp; &nbsp;TLSv1.2 TLSv1.3;&nbsp; &nbsp; &nbsp; &nbsp; ssl_ciphers&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;HIGH:!aNULL:!MD5;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; location / {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_pass&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;http://127.0.0.1:5001;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_http_version 1.1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header&nbsp; &nbsp;Upgrade $http_upgrade;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header&nbsp; &nbsp;Connection keep-alive;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header&nbsp; &nbsp;Host $host;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_cache_bypass $http_upgrade;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}stream {&nbsp; &nbsp; upstream dotnet_app_tcp {&nbsp; &nbsp; &nbsp; &nbsp; server 127.0.0.1:8445;&nbsp;&nbsp; &nbsp; }&nbsp;&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp; listen 14217 ssl;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate&nbsp; &nbsp; &nbsp;fullchain.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate_key privkey.pem;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ssl_protocols&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TLSv1.2 TLSv1.3;&nbsp; &nbsp; &nbsp; &nbsp; ssl_ciphers&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;HIGH:!aNULL:!MD5;&nbsp; &nbsp; &nbsp; &nbsp; ssl_prefer_server_ciphers on;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; proxy_pass dotnet_app_tcp;&nbsp; &nbsp; }}&nbsp;5. The bot’s Application Permissions have also been granted,as shown in the figure below:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;6. Bot initialization&nbsp; &nbsp; &nbsp; &nbsp; var mediaPlatformSettings = new MediaPlatformSettings&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ApplicationId = _botConfig.MicrosoftAppId,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MediaPlatformInstanceSettings = new MediaPlatformInstanceSettings&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CertificateThumbprint = _botConfig.CertificateThumbprint, // LocalMachine/My certificate-*.bottest.com-thumbprint&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; InstanceInternalPort = 8445,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; InstancePublicPort = 14217,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; InstancePublicIPAddress = IPAddress.Parse("18.181.xx.xx"), // AWS public IP&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ServiceFqdn = "media.bottest.com"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; _communicationsClient = new CommunicationsClientBuilder("IMediaSessionBot", _botConfig.MicrosoftAppId, _graphLogger)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .SetAuthenticationProvider(_authProvider)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .SetServiceBaseUrl(new Uri("https://graph.microsoft.com/v1.0"))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .SetNotificationUrl(new Uri($"{_botConfig.PublicUrl}/api/calls"))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .SetMediaPlatformSettings(mediaPlatformSettings)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .SetHttpClient(httpClient)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .Build();&nbsp; &nbsp; &nbsp; &nbsp; _communicationsClient.Calls().OnIncoming += this.OnIncomingCall;&nbsp; &nbsp; &nbsp; &nbsp; _communicationsClient.Calls().OnUpdated += OnCallUpdated;&nbsp; &nbsp; }&nbsp;7.join meeting&nbsp; &nbsp; &nbsp; &nbsp; var scenarioId = Guid.NewGuid();&nbsp; &nbsp; &nbsp; &nbsp; var meetingDetails = MeetingUrlParser.Parse(meetingUrl);&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; var chatInfo = new ChatInfo { ThreadId = meetingDetails.ThreadId };&nbsp; &nbsp; &nbsp; &nbsp; var meetingInfo = new JoinMeetingIdMeetingInfo&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; JoinMeetingId = _botConfig.MeetingID,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Passcode = _botConfig.MeetingPasscode,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; AdditionalData = new Dictionary&lt;string, object&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "allowConversationWithoutHost" , true&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; };&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ILocalMediaSession mediaSession = this.CreateLocalMediaSession();&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; var joinParams = new JoinMeetingParameters(chatInfo, meetingInfo, mediaSession)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TenantId = tenantId,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; AllowGuestToBypassLobby = true&nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; try&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _activeCall = await _communicationsClient.Calls().AddAsync(joinParams, scenarioId).ConfigureAwait(false);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; _logger.LogInformation($"Successfully initiated the add-participant request, Call ID:: {_activeCall.Id}");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; catch (ODataError ex)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Console.WriteLine($"{DateTime.Now:yyyy-MM-dd HH:mm:ss.fff} Failed to initiate the call: .ex={ex.ToString()}");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; throw;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;&nbsp; &nbsp; private ILocalMediaSession CreateLocalMediaSession(Guid mediaSessionId = default(Guid))&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; var mediaSession = this._communicationsClient.CreateMediaSession(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; new AudioSocketSettings&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; StreamDirections = StreamDirection.Recvonly,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; SupportedAudioFormat = AudioFormat.Pcm16K,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ReceiveUnmixedMeetingAudio = true,&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; EnableAudioHealingForUnmixed = true&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; new VideoSocketSettings&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; StreamDirections = StreamDirection.Inactive&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mediaSessionId: mediaSessionId);&nbsp; &nbsp; &nbsp; &nbsp; return mediaSession;&nbsp; &nbsp; }&nbsp;8.call back(SetNotificationUrl(new Uri($"{_botConfig.PublicUrl}/api/calls")))State at first attempt:Notification payload: {"@odata.type":"#microsoft.graph.commsNotifications","value":[{"@odata.type":"#microsoft.graph.commsNotification","changeType":"updated","resource":"/app/calls/07004d80-44b9-479e-bb43-2d5983e3f235","resourceUrl":"/communications/calls/07004d80-44b9-479e-bb43-2d5983e3f235","resourceData":{"@odata.type":"#microsoft.graph.call","state":"establishing","chatInfo":{"@odata.type":"#microsoft.graph.chatInfo","threadId":"19:meeting_MzIyMTYzOTMtMGYyNi00OTE2LTg2NjUtYmU4ZDlhYmY2ZmRj@thread.v2"},"meetingInfo":{"@odata.type":"#microsoft.graph.joinMeetingIdMeetingInfo","joinMeetingId":"4130864187312","passcode":"P7GY7Vv2","allowConversationWithoutHost":true},"callChainId":"b50a00dc-74da-42b0-966a-e88dea7e6087"}}]}State at second attempt:Notification payload: {"@odata.type":"#microsoft.graph.commsNotifications","value":[{"@odata.type":"#microsoft.graph.commsNotification","changeType":"deleted","resource":"/app/calls/07004d80-44b9-479e-bb43-2d5983e3f235","resourceUrl":"/communications/calls/07004d80-44b9-479e-bb43-2d5983e3f235","resourceData":{"@odata.type":"#microsoft.graph.call","state":"terminated","resultInfo":{"@odata.type":"#microsoft.graph.resultInfo","code":500,"subcode":1203002,"message":"Server Internal Error. DiagCode: 500#1203002.@"},"chatInfo":{"@odata.type":"#microsoft.graph.chatInfo","threadId":"19:meeting_MzIyMTYzOTMtMGYyNi00OTE2LTg2NjUtYmU4ZDlhYmY2ZmRj@thread.v2"},"meetingInfo":{"@odata.type":"#microsoft.graph.joinMeetingIdMeetingInfo","joinMeetingId":"4130864187312","passcode":"P7GY7Vv2","allowConversationWithoutHost":true},"callChainId":"b50a00dc-74da-42b0-966a-e88dea7e6087"}}]}Here, an error occurred: 500 #1203002.&nbsp;9. Based on the packet capture, the issue seems to be related to interactions with /MediaProcessor/v1.It’s unclear whether this is due to a protocol mismatch or a certificate mismatch,as shown in the figure below:&nbsp;&nbsp;&nbsp;10.Database schema (DDL) dependencies required by the bot&nbsp; &lt;ItemGroup&gt;&lt;PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="2.23.0" /&gt;&lt;PackageReference Include="Microsoft.Azure.Functions.Worker" Version="1.24.0" /&gt;&lt;PackageReference Include="Microsoft.Azure.Functions.Worker.ApplicationInsights" Version="1.4.0" /&gt;&lt;PackageReference Include="Microsoft.Azure.Functions.Worker.Core" Version="1.20.0" /&gt;&lt;PackageReference Include="Microsoft.Azure.Functions.Worker.Extensions.Http" Version="3.3.0" /&gt;&lt;PackageReference Include="Microsoft.Azure.Functions.Worker.Sdk" Version="1.18.1" /&gt;&lt;PackageReference Include="Microsoft.AspNetCore" Version="2.1.3" /&gt;&lt;PackageReference Include="Microsoft.AspNetCore.Mvc" Version="2.1.2" /&gt;&lt;PackageReference Include="Microsoft.Bot.Builder.Integration.AspNet.WebApi" Version="4.22.1" /&gt;&lt;PackageReference Include="Microsoft.CognitiveServices.Speech" Version="1.46.0" /&gt;&lt;PackageReference Include="Microsoft.Graph.Communications.Calls.Media" Version="1.2.0.10563" /&gt;&lt;PackageReference Include="Microsoft.Graph.Communications.Core" Version="1.2.0.10563" /&gt;&lt;PackageReference Include="Microsoft.Graph.Core" Version="3.1.3" /&gt;&lt;PackageReference Include="Microsoft.IO.RecyclableMemoryStream" Version="3.0.1" /&gt;&lt;PackageReference Include="Microsoft.ServiceFabric.AspNetCore.HttpSys" Version="3.2.187" /&gt;&lt;PackageReference Include="Microsoft.Skype.Bots.Media" Version="1.31.0.180" /&gt;&lt;PackageReference Include="Microsoft.Kiota.Http.HttpClientLibrary" Version="1.3.3" /&gt;&nbsp; &lt;/ItemGroup&gt;&nbsp;11.The certificate has also been uploaded to Azure, as shown in the figure:&nbsp;

nivedipa-msft · Answer

@guoxl - Thanks for bringing this issue to our attention.Based on your detailed setup and the error code&nbsp;500#1203002, this is a&nbsp;Microsoft Teams Real-time Media Platform connectivity issue. The error indicates the Teams media service cannot establish a secure connection to your media endpoint.
Root Cause Analysis
Error&nbsp;500#1203002&nbsp;typically means:

Media platform connectivity failure
Certificate/TLS handshake issues
Network routing problems&nbsp;between Teams and your media endpoint
Protocol mismatch in media negotiation

Critical Issues in Your Setup
1. Media Platform Configuration Issues
Problem: Your&nbsp;ServiceFqdn&nbsp;and certificate don't match your Nginx configuration.
Current Setup:ServiceFqdn = "media.bottest.com" &nbsp;// But Nginx serves signaling.bottest.com
Corrected Configuration:var mediaPlatformSettings = new MediaPlatformSettings{&nbsp; &nbsp; ApplicationId = _botConfig.MicrosoftAppId,&nbsp; &nbsp; MediaPlatformInstanceSettings = new MediaPlatformInstanceSettings&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; CertificateThumbprint = _botConfig.CertificateThumbprint,&nbsp; &nbsp; &nbsp; &nbsp; InstanceInternalPort = 8445,&nbsp; &nbsp; &nbsp; &nbsp; InstancePublicPort = 14217,&nbsp; &nbsp; &nbsp; &nbsp; InstancePublicIPAddress = IPAddress.Parse("18.181.xx.xx"),&nbsp; &nbsp; &nbsp; &nbsp; ServiceFqdn = "signaling.bottest.com" // ✅ Match your Nginx server_name&nbsp; &nbsp; }};
2. Nginx Configuration Problems
Issue: Missing UDP support and incorrect SSL configuration for media.
Corrected Nginx Configuration:
# /etc/nginx/nginx.confevents {&nbsp; &nbsp; worker_connections 1024;}
http {&nbsp; &nbsp; # Signaling endpoint (HTTPS)&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp; listen 443 ssl http2;&nbsp; &nbsp; &nbsp; &nbsp; server_name signaling.bottest.com;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate &nbsp; &nbsp; /path/to/fullchain.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate_key /path/to/privkey.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_protocols &nbsp; &nbsp; &nbsp; TLSv1.2 TLSv1.3;&nbsp; &nbsp; &nbsp; &nbsp; ssl_ciphers &nbsp; &nbsp; &nbsp; &nbsp; ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA;&nbsp; &nbsp; &nbsp; &nbsp; ssl_prefer_server_ciphers off;&nbsp; &nbsp; &nbsp; &nbsp; ssl_dhparam /path/to/dhparam.pem;
&nbsp; &nbsp; &nbsp; &nbsp; # Important: Add these headers for Teams compatibility&nbsp; &nbsp; &nbsp; &nbsp; add_header Strict-Transport-Security "max-age=63072000" always;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; location / {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_pass &nbsp; &nbsp; &nbsp; &nbsp; http://127.0.0.1:5001;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_http_version 1.1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; Upgrade $http_upgrade;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; Connection $connection_upgrade;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; Host $host;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; X-Real-IP $remote_addr;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; X-Forwarded-For $proxy_add_x_forwarded_for;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; X-Forwarded-Proto $scheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_cache_bypass $http_upgrade;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_read_timeout 86400;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}
# Media endpoint (TCP/TLS)stream {&nbsp; &nbsp; # Connection upgrade mapping&nbsp; &nbsp; map $http_upgrade $connection_upgrade {&nbsp; &nbsp; &nbsp; &nbsp; default upgrade;&nbsp; &nbsp; &nbsp; &nbsp; '' close;&nbsp; &nbsp; }
&nbsp; &nbsp; upstream media_backend {&nbsp; &nbsp; &nbsp; &nbsp; server 127.0.0.1:8445;&nbsp; &nbsp; }
&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp; listen 14217 ssl;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate &nbsp; &nbsp; /path/to/fullchain.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate_key /path/to/privkey.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_protocols &nbsp; &nbsp; &nbsp; TLSv1.2 TLSv1.3;&nbsp; &nbsp; &nbsp; &nbsp; ssl_ciphers &nbsp; &nbsp; &nbsp; &nbsp; ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;&nbsp; &nbsp; &nbsp; &nbsp; ssl_prefer_server_ciphers on;&nbsp; &nbsp; &nbsp; &nbsp; ssl_session_cache &nbsp; shared:SSL:10m;&nbsp; &nbsp; &nbsp; &nbsp; ssl_session_timeout 10m;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; proxy_pass media_backend;&nbsp; &nbsp; &nbsp; &nbsp; proxy_timeout 1s;&nbsp; &nbsp; &nbsp; &nbsp; proxy_responses 1;&nbsp; &nbsp; &nbsp; &nbsp; proxy_bind $remote_addr transparent;&nbsp; &nbsp; }}
&nbsp;
3. Certificate Issues
Problem: Certificate chain and validation issues.
Required Certificate Setup:
# Verify certificate chainopenssl x509 -in fullchain.pem -text -nooutopenssl verify -CAfile chain.pem fullchain.pem
# Certificate must include:# - Subject: CN=*.bottest.com# - Subject Alternative Names: signaling.bottest.com, media.bottest.com# - Full certificate chain including intermediates
&nbsp;
Install Certificate Properly:
# PowerShell on Windows Server$cert = Import-PfxCertificate -FilePath "certificate.pfx" -CertStoreLocation "Cert:\LocalMachine\My" -Password (ConvertTo-SecureString "password" -AsPlainText -Force)$thumbprint = $cert.Thumbprint
# Verify certificate is accessibleGet-ChildItem -Path "Cert:\LocalMachine\My" | Where-Object {$_.Thumbprint -eq $thumbprint}
&nbsp;
4. AWS Security Group Configuration
Required Ports:
# Inbound RulesHTTPS &nbsp; &nbsp;443 &nbsp; &nbsp;0.0.0.0/0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # SignalingTCP &nbsp; &nbsp; &nbsp;14217 &nbsp;0.0.0.0/0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Media (TLS)UDP &nbsp; &nbsp; &nbsp;14217 &nbsp;0.0.0.0/0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Media (DTLS) - IMPORTANT!
# Outbound Rules &nbsp;All Traffic &nbsp;0.0.0.0/0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # Allow all outbound
&nbsp;
5. Windows Server Configuration
Required Services and Ports:
# Disable Windows Firewall completely for testingSet-NetFirewallProfile -Profile Domain,Public,Private -Enabled False
# Enable required Windows featuresEnable-WindowsOptionalFeature -Online -FeatureName IIS-WebServerRoleEnable-WindowsOptionalFeature -Online -FeatureName IIS-ASPNET45
# Verify port bindingnetstat -an | findstr ":8445"netstat -an | findstr ":14217"
Could you review the points above and let us know if you encounter any issues?

guoxl · Answer

First of all, thank you for your response, but the same error still occurs.Media Platform Configuration Issues=&gt; Change ServiceFqdn to "signaling.bottest.com"The result of the MediaPlatformSettings configuration is as follows:[2025-10-01T15:14:23.635Z] =================CertificateThumbprint=[xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx337F6A7A][2025-10-01T15:14:23.642Z] =================InstanceInternalPort=[8445][2025-10-01T15:14:23.645Z] =================InstancePublicPort=[14217][2025-10-01T15:14:23.647Z] =================InstancePublicIPAddress=[18.181.xx.xx][2025-10-01T15:14:23.649Z] =================ServiceFqdn=[signaling.bottest.com]2. Nginx Configuration Problems=&gt;The corresponding changes have also been made in C:\bot
ginx-1.29.1\conf
ginx.conf:events {&nbsp; &nbsp; worker_connections &nbsp;1024;}http {&nbsp; &nbsp; include &nbsp; &nbsp; &nbsp; mime.types;&nbsp; &nbsp; default_type &nbsp;application/octet-stream;&nbsp; &nbsp; log_format &nbsp;main &nbsp;'$remote_addr - $remote_user [$time_local] "$request" '&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; '$status $body_bytes_sent "$http_referer" '&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; '"$http_user_agent" "$http_x_forwarded_for"';&nbsp; &nbsp; access_log &nbsp;logs/access.log &nbsp;main;&nbsp; &nbsp; sendfile &nbsp; &nbsp; &nbsp; &nbsp;on;&nbsp; &nbsp; #tcp_nopush &nbsp; &nbsp; on;&nbsp; &nbsp; #keepalive_timeout &nbsp;0;&nbsp; &nbsp; keepalive_timeout &nbsp;65;&nbsp; &nbsp; #gzip &nbsp;on;&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp; listen &nbsp; &nbsp; &nbsp; 80;&nbsp; &nbsp; &nbsp; &nbsp; server_name &nbsp;localhost;&nbsp; &nbsp; &nbsp; &nbsp; location / {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; root &nbsp; html;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; index &nbsp;index.html index.htm;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; # Connection upgrade mapping&nbsp; &nbsp; map $http_upgrade $connection_upgrade {&nbsp; &nbsp; &nbsp; &nbsp; default upgrade;&nbsp; &nbsp; &nbsp; &nbsp; '' close;&nbsp; &nbsp; }&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp; listen 443 ssl;&nbsp; &nbsp; &nbsp; &nbsp; http2 on;&nbsp; &nbsp; &nbsp; &nbsp; server_name signaling.bottest.com;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate &nbsp; &nbsp; C:/bot/bottest-rsa/fullchain.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate_key C:/bot/bottest-rsa/privkey.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_protocols &nbsp; &nbsp; &nbsp; TLSv1.2 TLSv1.3;&nbsp; &nbsp; &nbsp; &nbsp; ssl_ciphers &nbsp; &nbsp; &nbsp; &nbsp; ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA;&nbsp; &nbsp; &nbsp; &nbsp; ssl_prefer_server_ciphers off;&nbsp; &nbsp; &nbsp; &nbsp; ssl_dhparam C:/bot/nginx-1.29.1/conf/dhparam.pem;&nbsp; &nbsp; &nbsp; &nbsp; # Important: Add these headers for Teams compatibility&nbsp; &nbsp; &nbsp; &nbsp; add_header Strict-Transport-Security "max-age=63072000" always;&nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; location / {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_pass &nbsp; &nbsp; &nbsp; &nbsp; http://127.0.0.1:5001;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_http_version 1.1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; Upgrade $http_upgrade;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; Connection $connection_upgrade;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; Host $host;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; X-Real-IP $remote_addr;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; X-Forwarded-For $proxy_add_x_forwarded_for;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_set_header &nbsp; X-Forwarded-Proto $scheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_cache_bypass $http_upgrade;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; proxy_read_timeout 86400;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}stream {&nbsp; &nbsp; upstream media_backend {&nbsp; &nbsp; &nbsp; &nbsp; server 127.0.0.1:8445;&nbsp; &nbsp; }&nbsp; &nbsp; server {&nbsp; &nbsp; &nbsp; &nbsp; listen 14217 ssl;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate &nbsp; &nbsp; C:/bot/bottest-rsa/fullchain.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_certificate_key C:/bot/bottest-rsa/privkey.pem;&nbsp; &nbsp; &nbsp; &nbsp; ssl_protocols &nbsp; &nbsp; &nbsp; TLSv1.2 TLSv1.3;&nbsp; &nbsp; &nbsp; &nbsp; ssl_ciphers &nbsp; &nbsp; &nbsp; &nbsp; ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;&nbsp; &nbsp; &nbsp; &nbsp; ssl_prefer_server_ciphers on;&nbsp; &nbsp; &nbsp; &nbsp; ssl_session_cache &nbsp; shared:SSL:10m;&nbsp; &nbsp; &nbsp; &nbsp; ssl_session_timeout 10m;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; proxy_pass media_backend;&nbsp; &nbsp; &nbsp; &nbsp; proxy_timeout 1s;&nbsp; &nbsp; &nbsp; &nbsp; proxy_responses 1;# &nbsp; &nbsp; &nbsp; &nbsp;proxy_bind $remote_addr transparent;&nbsp; &nbsp; }}3. Certificate Issues3.1.openssl x509 -in fullchain.pem -text -noout=&gt;The execution result is as follows:C:\bot\bottest-rsa&gt;"C:\Program Files\OpenSSL-Win64\bin\openssl" x509 -in fullchain.pem -text -nooutCertificate:&nbsp; &nbsp; Data:&nbsp; &nbsp; &nbsp; &nbsp; Version: 3 (0x2)&nbsp; &nbsp; &nbsp; &nbsp; Serial Number:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 05:6a:f7:c5:...&nbsp; &nbsp; &nbsp; &nbsp; Signature Algorithm: sha256WithRSAEncryption&nbsp; &nbsp; &nbsp; &nbsp; Issuer: C=US, O=Let's Encrypt, CN=R12&nbsp; &nbsp; &nbsp; &nbsp; Validity&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Not Before: Sep 23 13:21:51 2025 GMT&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Not After : Dec 22 13:21:50 2025 GMT&nbsp; &nbsp; &nbsp; &nbsp; Subject: CN=*.bottest.com&nbsp; &nbsp; &nbsp; &nbsp; Subject Public Key Info:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Public Key Algorithm: rsaEncryption&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Public-Key: (2048 bit)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Modulus:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 00:c6:70:...&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Exponent: 65537 (0x10001)&nbsp; &nbsp; &nbsp; &nbsp; X509v3 extensions:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X509v3 Key Usage: critical&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Digital Signature, Key Encipherment&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X509v3 Extended Key Usage:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; TLS Web Server Authentication, TLS Web Client Authentication&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X509v3 Basic Constraints: critical&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CA:FALSE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X509v3 Subject Key Identifier:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A2:56:99:2F:C7:42:29:6D:AF:9C:85:27:32:C0:7E:4B:14:0E:79:6D&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X509v3 Authority Key Identifier:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 00:B5:29:F2:2D:8E:6F:31:E8:9B:4C:AD:78:3E:FA:DC:E9:0C:D1:D2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Authority Information Access:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CA Issuers - URI:http://r12.i.lencr.org/&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X509v3 Subject Alternative Name:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DNS:*.bottest.com&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X509v3 Certificate Policies:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Policy: 2.23.140.1.2.1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; X509v3 CRL Distribution Points:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Full Name:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; URI:http://r12.c.lencr.org/98.crl&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CT Precertificate SCTs:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Signed Certificate Timestamp:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Version &nbsp; : v1 (0x0)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Log ID &nbsp; &nbsp;: A4:42:C5:06...&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Timestamp : Sep 23 14:20:21.550 2025 GMT&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Extensions: none&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Signature : ecdsa-with-SHA256&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 30:44:02:20:...&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Signed Certificate Timestamp:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Version &nbsp; : v1 (0x0)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Log ID &nbsp; &nbsp;: 12:F1:4E:34:...&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Timestamp : Sep 23 14:20:21.552 2025 GMT&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Extensions: none&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Signature : ecdsa-with-SHA256&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 30:45:02:21:...&nbsp; &nbsp; Signature Algorithm: sha256WithRSAEncryption&nbsp; &nbsp; Signature Value:&nbsp; &nbsp; &nbsp; &nbsp; 5f:4a:46...3.2.openssl verify -CAfile chain.pem fullchain.pem=&gt;The first time, it reported the following error:C:\bot\bottest-rsa&gt;"C:\Program Files\OpenSSL-Win64\bin\openssl" verify -CAfile chain.pem fullchain.pemC=US, O=Let's Encrypt, CN=R12error 2 at 1 depth lookup: unable to get issuer certificateerror fullchain.pem: verification failedThen, open the page：https://letsencrypt.org/certificates/Locate the ISRG Root X1 section.Click Certificate Details → PEM (usually labeled as .pem format).Append ISRG Root X1 to the end of chain.pem.Then execute:C:\bot\bottest-rsa&gt;"C:\Program Files\OpenSSL-Win64\bin\openssl" verify -CAfile chain.pem fullchain.pemfullchain.pem: OK，The verification was successful.3.3.Generate the certificate:openssl pkcs12 -export -out cert.pfx -inkey privkey.pem -in fullchain.pem3.4.Import the certificate into LocalMachine.Import-PfxCertificate -FilePath "certificate.pfx" -CertStoreLocation "Cert:\LocalMachine\My" -Password (ConvertTo-SecureString "password" -AsPlainText -Force)3.5.Verify certificate is accessiblePS C:\bot\bottest-rsa&gt; Get-ChildItem -Path "Cert:\LocalMachine\My" | Where-Object {$_.Thumbprint -eq $thumbprint}&nbsp; &nbsp;PSParentPath: Microsoft.PowerShell.Security\Certificate::LocalMachine\MyThumbprint &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Subject---------- &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;-------xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx337F6A7A &nbsp;CN=*.bottest.com4. AWS Security Group Configuration=&gt;As shown in the figure:5. Windows Server Configuration=&gt;The IIS-WebServerRole and IIS-ASPNET45 roles have been installed.Ports 8445 and 14217 are being monitored as shown in the figure:

guoxl · Answer

To make it easier to identify the issue, here are some excerpts from the logs:&nbsp;

guoxl · Answer

To make it easier to identify the issue, here are some excerpts from the logs:Logs after joining the meeting:&nbsp;

guoxl · Answer

I just captured a GET request to /MediaProcessor/v1 in packet capture tool (Full request URI: http://signaling.softroadngroks.com:14217/MediaProcessor/v1). Do I need to configure nginx to forward port 14217 as well?

Forum Discussion

Azure Bot not joining meeting - Server Internal Error. DiagCode: 500#1203002.@

7 Replies

Root Cause Analysis

Critical Issues in Your Setup

1. Media Platform Configuration Issues

2. Nginx Configuration Problems

3. Certificate Issues

4. AWS Security Group Configuration

5. Windows Server Configuration

Resources