Well I feel like I am making some progress.
I deleted and re created the ext. Here is what sip debug shows in asterisk.
<--- SIP read from WS:1.2.3.2:57922 --->
[Mar 8 11:09:37] SIP/2.0 488 Not Acceptable Here
[Mar 8 11:09:37] Via: SIP/2.0/WS 1.2.3.4:0;branch=z9hG4bK735e503c;rport
[Mar 8 11:09:37] To: <sip:vi4trqgv@192.0.2.197(Whos ip is this?);transport=wss>;tag=m4g576785n
[Mar 8 11:09:37] From: "ACagcW15205361306666666666666666" <sip:0000000000@1.2.3.4:0>;tag=as6394f272
[Mar 8 11:09:37] Call-ID: 78d4aa630dd4b84022ddab7032aaa070@1.2.3.4:0
[Mar 8 11:09:37] CSeq: 102 INVITE
[Mar 8 11:09:37] Supported: outbound
[Mar 8 11:09:37] User-Agent: VICIphone 1.0-rc1
[Mar 8 11:09:37] Content-Length: 0
Here are requests.
https://imgur.com/dl9qtun
https://imgur.com/I5UcHMg
So I think the intial cert problem is fixed because I realized the extension had to be created after you made the template for said extensions. Now I see this 488.