3cx V20 - Yealink T54W provisions but fails to update config

[MedjoPangit]

I just built a newly installed 3cx v20 PBX in our datacenter, and I'm trying to setup some T54W units to connect. Since these units are router phones, there is no SBC required, as one of the phones (given it's on the same network as the others) will act as the SBC. When I add the phone, it provisions and sets up correctly and works... but then if I make any changes (for example, adding a BLF entry), they never get pushed out. I've tested this using both a direct connection and with an SBC (tried with both actual SBC and router phone), and still I get no config updates. I downloaded the local logs on the IP phone, and noticed one particular line in the boot.log file:

Feb 14 17:00:20 sua [1048.1095]: REG <3+error > [000] <AEM> [rid=0] code=0x0001000000040000 text="Register fail",reason=Can not build register,reason_code=-7,server_addr=*******.com:5060,transport=UNKONW,lid=0

Is this normal?

Additionally, I also noticed when I setup a second T54W IP phone on the same network, and add it via the first router phone I setup, it also successfully registers the first time, but the 3CX wallpaper and screensaver do not get applied.

Additionally, once again, I noticed the 3CX phonebook is not accessible from the IP phone. It says cannot download remote phone book. But when I log into the phone's web UI and look at Directory > Remote Phone Book, sure enough, there is an entry with Display Name 3CX Phonebook, and the correct URL (https://*****.com/provisioning/*****/yealink_phonebook.xml) which if I directly enter into my address bar, I can access.

Calling and most normal functions work- when another extensions calls, it shows the correct information, and vice versa...

I've tried this, already, even though it sounds like it was just an issue in v18 and v16... I'm kind of at a loss.

 

[MedjoPangit]

Addition: I tested this on a T42S, with updated firmware, (firmware on the T54W's was also up to date), and same problem (minus the wallpaper, of course, with there only being a minimal display). Why can I get to these provisioning links, but the handsets cannot?

 

[MedjoPangit]

Okay, I've very much narrowed this down. I did a packet trace and found I'm getting continual TLS handshake failures, even though we're using a valid LetsEncrypt cert, which I tested just to double check. See the packet capture for details. I think there might be an abstract bug that has something to do with LetsEncrypt...

 

[MedjoPangit]

And I've tried this on other phone models, including the Yealink T42S, as well. At this point, if I could recategroize this issue differently, I would.

 

[MedjoPangit]

Update: I tried reinstalling the PBX server about a half dozen times, switching occasionally between v18 and v20, and noticed in v18 when I would set it up the "legacy" method, and then run LetsEncrypt to update our certs, it would make the PBX webserver totally inaccessible by hostname, as it would say there was an unrecognized security cipher. This went on for at least a few days, and then magically stopped happening one day... and we're still not sure why. But, for better or for worse, the issue is solved... though I really wish I know what caused it.