OK, spent some time around tls configuration. OpenSSL shows no error now, but dispatcher continues to show me IP or AX.

openssl s_client -showcerts -debug -connect servername.com:5061 -no_ssl2 -bugs -servername  servername.com -CAfile /root/intermediate.crt

<goodgoodgoodnoerrors>

kamalio.cfg

....

####### Routing Logic ########

event_route[tm:local-request] {

        if(is_method("OPTIONS") && $ru =~ "pstnhub.microsoft.com") {
               append_hf("Contact: <sip:servername.com:5061;transport=tls>\r\n");
        }
        xlog("L_INFO", "Sent out tm request: $mb\n");
}

request_route {

...

        if (is_method("INVITE|SUBSCRIBE")) {
                record_route_preset("servername.com:5061;transport=tls", "my_ip:5060");
                #record_route();
        }

...

}

route[WITHINDLG] {
        if (!has_totag()) return;

        # sequential request withing a dialog should
        # take the path determined by record-routing
        if (loose_route()) {
                route(DLGURI);
                if (is_method("BYE")) {
                        setflag(FLT_ACC); # do accounting ...
                        setflag(FLT_ACCFAILED); # ... even if the transaction fails
                } else if ( is_method("ACK") ) {
                        # ACK is forwarded statelessly
                        route(NATMANAGE);
                } else if ( is_method("NOTIFY") ) {
                        # Add Record-Route for in-dialog NOTIFY as per RFC 6665.
                record_route_preset("servername.com:5061;transport=tls", "my_ip:5060");
                        #record_route();
                }
                route(RELAY);
                exit;
        }

Teams web-interface shows inactive. Kamcmd's same as previous output. What do I do :(?