Solved Certificate error Yealink?

[Paultechnica]

Hi all

Is anyone having troubles autoprovisioning yealink IP phones?

 

[Paultechnica]

It partially did, in that it allowed a hotdesk phone to sign in. However the phone does not appear as being behind an SBC in the phones page, so not sure it is working correctly. Also, not sure if this is the same on the yealinks, but the system time on the phone itself is out by nearly two months. I know the time was correct on this phone last night as i set it manually.

Well, it beats being unavailable for customers..........
Is there any update 3CX? @YiannisH_3CX

 

[YiannisH_3CX]

Thank you for your patience so far. We are currently testing the solution. We will have an update within the day with the necessary steps to run to resolve it. We are nearly there

 

[YiannisH_3CX]

We have come up with a solution but first read who should apply the solution:

1. If you are “Hosted by 3CX”, you have already been taken care of.
2. If you don't use IP Phones or are not facing any of the issues mentioned in this thread, you may stop here. (Within the next 90 days your system will automatically update the certificates with the new certificate chain.)
3. If you are operating on custom domains, you will have to validate any impact and find a solution which works for your setup. The below solutions only apply to 3CX provided FQDNs and certificates.
4. If you or your customers are currently facing any of the limitations mentioned above, please read on

Linux based installations (V16 & V18)​

Use the below script and execute it from SSH (root permissions required) to update your current certificate chain.

wget -O - https://downloads.3cx.com/downloads/misc/debianpatches/10/18/0/remove_expired_le_cert.sh | bash

Windows based installations (V16 & V18)​

Follow the below steps to immediately request a new certificate to update the current certificate chain.

1. Open the 3CX Management Console
2. Navigate to “Settings” > “Parameters”
3. Set or add TEMPORARY_SELF_SIGNED_CERTIFICATE_GENERATED
   in the parameter table and give it the value of 1
   
   
4. On the host running 3CX open a command prompt (CMD)
5. Type the following command:
   "C:\Program Files\3CX Phone System\Bin\PbxConfigTool.exe" -renew-certificates

Press Enter and the result should look something like this:

Please note that we are also working on a hotfix that will appear in your management console at some point later on which does exactly the same thing so do not get confused when you see it. Even if you also run that it should not change anything.

Please let us know if you face any issues.

 

[TitleRequired]

Run the command on a Debian system, but no real indication it has 'done anything' other than look for some certificate files.

Will test hotdesking.

 

[YiannisH_3CX]

It will check for certificates and delete the wrong one if it finds it. It will give you no other indication.

 

[TitleRequired]

It will check for certificates and delete the wrong one if it finds it. It will give you no other indication.

It would be more helpful, at least to me, to see some indication of if it has found/removed something or if it has made no changes.

 

[TitleRequired]

Seems to be working on a Yealink T46S, will try Fanvil X4 next.

 

[Wesley Telecomlijn]

We have come up with a solution but first read who should apply the solution:

1. If you are “Hosted by 3CX”, you have already been taken care of.
2. If you don't use IP Phones or are not facing any of the issues mentioned in this thread, you may stop here. (Within the next 90 days your system will automatically update the certificates with the new certificate chain.)
3. If you are operating on custom domains, you will have to validate any impact and find a solution which works for your setup. The below solutions only apply to 3CX provided FQDNs and certificates.
4. If you or your customers are currently facing any of the limitations mentioned above, please read on

Linux based installations (V16 & V18)​

Use the below script and execute it from SSH (root permissions required) to update your current certificate chain.

wget -O - https://downloads.3cx.com/downloads/misc/debianpatches/10/18/0/remove_expired_le_cert.sh | bash 2> /dev/null

Windows based installations (V16 & V18)​

Follow the below steps to immediately request a new certificate to update the current certificate chain.

1. Open the 3CX Management Console
2. Navigate to “Settings” > “Parameters”
3. Set or add TEMPORARY_SELF_SIGNED_CERTIFICATE_GENERATED
   in the parameter table and give it the value of 1
   
   
4. On the host running 3CX open a command prompt (CMD)
5. Type the following command:
   "C:\Program Files\3CX Phone System\Bin\PbxConfigTool.exe" -renew-certificates

Press Enter and the result should look something like this:

Please note that we are also working on a hotfix that will appear in your management console at some point later on which does exactly the same thing so do not get confused when you see it. Even if you also run that it should not change anything.

Please let us know if you face any issues.

I've run the Linux script and this worked for the T54W, T46G, T58A.

If you have your instances hosted at Google Cloud Platform you can use this script to run the linux commando on each instance inside the selected project. You can run this script on your cloud shell. Don't forget to select the right project

for instance in $(gcloud compute instances list --format='value[separator=","](name,zone)'); do
  name="${instance%,*}";
  zone="${instance#*,}";
  gcloud compute ssh $name --zone=$zone --command="sudo su root -c 'wget -O - https://downloads.3cx.com/downloads/misc/debianpatches/10/18/0/remove_expired_le_cert.sh | bash 2> /dev/null'"
done

 

[Matt_AIT]

We have come up with a solution but first read who should apply the solution:

1. If you are “Hosted by 3CX”, you have already been taken care of.
2. If you don't use IP Phones or are not facing any of the issues mentioned in this thread, you may stop here. (Within the next 90 days your system will automatically update the certificates with the new certificate chain.)
3. If you are operating on custom domains, you will have to validate any impact and find a solution which works for your setup. The below solutions only apply to 3CX provided FQDNs and certificates.
4. If you or your customers are currently facing any of the limitations mentioned above, please read on

Linux based installations (V16 & V18)​

Use the below script and execute it from SSH (root permissions required) to update your current certificate chain.

wget -O - https://downloads.3cx.com/downloads/misc/debianpatches/10/18/0/remove_expired_le_cert.sh | bash 2> /dev/null

Windows based installations (V16 & V18)​

Follow the below steps to immediately request a new certificate to update the current certificate chain.

1. Open the 3CX Management Console
2. Navigate to “Settings” > “Parameters”
3. Set or add TEMPORARY_SELF_SIGNED_CERTIFICATE_GENERATED
   in the parameter table and give it the value of 1
   
   
4. On the host running 3CX open a command prompt (CMD)
5. Type the following command:
   "C:\Program Files\3CX Phone System\Bin\PbxConfigTool.exe" -renew-certificates

Press Enter and the result should look something like this:

Please note that we are also working on a hotfix that will appear in your management console at some point later on which does exactly the same thing so do not get confused when you see it. Even if you also run that it should not change anything.

Please let us know if you face any issues.

Will give this a go, thanks.

Will the issue be present if I was to setup an Axure based 3cx new?

 

[YiannisH_3CX]

Will the issue be present if I was to setup an Axure based 3cx new?

All new installations should be fine as certificates will be freshly generated.

 

[Reece Cawthorn]

I am attempting to action the solution via a Linux Based Solution and I am encountering the following error message:

"Cannot write to ‘-’ (Broken pipe)."

Please can you advise what may be causing this/how to resolve?

 

[Charles_3CX]

Please see here: https://www.3cx.com/blog/releases/lets-encrypt-expiration/

 

[Sven Witlox]

I see that the hotfix available via the update page. Great job guys!

 

[Wesley Telecomlijn]

I am attempting to action the solution via a Linux Based Solution and I am encountering the following error message:

"Cannot write to ‘-’ (Broken pipe)."

Please can you advise what may be causing this/how to resolve?

You can ignore this issue. You can also run the hotfix update at the updates page in 3CX.

 

[JohnS_3CX]

The issue has been resolved via a Hotfix that will appear in your management console.
https://www.3cx.com/blog/releases/lets-encrypt-expiration/