Skype For Business - TLS

We're in the process of migrating from an older LTM running 11.6 to a new LTM running 13.1.

In our existing environment we have configured Skype for Business with the iApp for Lync.

This has worked well and we've been running with this for nearly 2 years.

Upon attempted migration to the new LTM, this using the latest Skype for Business iApp, we found that were having issues with some users.

Further investigation revealed that on the new LTM, for the SIP (port 5061) virtual server, SSL passthrough was used. This is the same as on the existing LTM.

However, when we tried connecting the this address and port with cURL, we do not get a response from any of the Skype front-end servers behind the F5. Adding client and server SSL profiles, thus putting the Virtual Server in SSL bridging mode, a response is received from one of the Skype servers (round robin, as expected)

Connecting to the VIP on the older LTM, with cURL, in SSL passthrough mode gets a response from the Skype servers.

We do have a case open with support and they are going to take a look at a trace, but their initial assessment is the configs look pretty similar.

The question to the community, is what is the recommended setup for SSL/TLS with Skype for Business?