Name is not displaying

[Brock_4118]

This problem started only after i renewed SSL certificate & i choose http authentication method

 

[AWS2P]

you don't use Let's Encrypt certificate provided by 3CX?

Why not updating pbx to latest V16 ?

 

[Brock_4118]

How much time does it take to upgrade to latest version ? will it affect to my current settings ?
Until now problem is still there,
i also notice that in ip phone when i am trying to update phonebook it gives mean error CANNOT DOWNLOAD REMOTE PHONEBOOK

 

[AWS2P]

What brand and phone model do you use?

A V16 upgrade take about a quater

1. You need to complete backup your V15.5 SP6
2. Save the file out of 3CX folders or completly out of PBX computer
3. uninstal V15.5
4. Reboot
5. during install V16 SP2 use the backup file to restore your Pbx config
6. Update your phone FW if needed
7. Use latest 3CX templates according to V16 SP2
8. Reprovision the phones if needed
9. enjoy calls

 

[JohnS_3CX]

Since the remote phonebook was not downloaded, the phone cannot display the name of the person you are dialing.

The phone will speak to the PBX via HTTPS to download the phonebook, but if the phone does not trust the new certificate, this will not be possible. I don't think you mentioned the phone models or which Root CA issued the new certificate you are using.

Note: Some older phone models also don't support the new TLS protocol version and the PBX might not allow them to connect unless you disable SSL Transport and Ciphers option in the PBX security settings (which allows older TLS versions to pass along with newer versions).

 

[Brock_4118]

Hi @SupportTeam
We are using Yealink T21 E2 phone models, as i have mentioned before also i have recently updated my SSL certificate where our PBX is configured only after that i have faced this issue, just now i have disable option called ONLY ACCEPT TRUSTED CERTIFICATE in one phone & i can see the name while dialing an extension number.
So should i have disable TRUSTED CERTIFICATE option in each phone (we have many phones in different branches & it will be tedious & time consuming process ) or is that any other way to do this ?

 

[JohnS_3CX]

Ok it seems pretty clear that your phones do not trust your new certificate. You must use one that they trust and this problem can be avoided.

Can you tell me what version your T21P E2 firmware is and how you generated/where you got the new certificate from?

 

[Brock_4118]

I have actually updated the firmware before disabling the certificate option but that didn't work.
The phone firmware is 52.84.0.15 .
i have got new certificate from local CA provider ( before also we got out SSL from the same provider & that time i have choosen the email authentication method & i didn't have this issue ) i have generated the CSR first then we have choose a HTTPS method for authentication & then i have put the SSL certificate into the server.

 

[JohnS_3CX]

In 3CX V15.5.15502.6 you should be on firmware version 52.83.0.55 for the T21P E2

Did your provider generate PEM type certificates like in our guide?https://www.3cx.com/docs/self-hosted-instances-ssh/

 

[Brock_4118]

Hello @JohnS_3CX ,
I do upgrade firmware on some phones because sometime when i tried to re-provisioned the phone with the new name it doesn't apply that's why i had to upgrade the firmware & after that name & other settings applied.
Now i have few other older certificate into that instance folder which i already changed their name before putting new cert & pem files & 3 files i have with exact configuration as suggested in the given link above.
Should i have to delete those old files & then restart the NGINX service ?

 

[JohnS_3CX]

Yes, please remove the older files or store them in a zip file.

Ensure that the new certificates are generated as PEM (not just renamed) and restart NGINX.

You might have to check whether your phones support the certificates that your provider generates. Yealink provides a "built-in certificate list" to compare if you want.

 

[Brock_4118]

Hi,
As your suggestion i have removed the old files & new certificate are PEM as well & restarted the nginx service but still no luck.
i have checked in the yealink forum of supported built in certificate list & i don'f find my CA in that list but i just spoke to provider & he said it is the same CA just the name is different.
Currently when i cheked in my website it shows verified by Spectigo Limited before we had COMODO which does shows into buit in list of yealink.
check the refer link , https://sectigo.com/sectigo-story-faq

 

[Brock_4118]

The only solution that worked for me is that when i disable the accept only trusted certificate option from the settings of yealink phone then only i can see the name when dialing extension number.

 

[AWS2P]

Have done same setting with same phones otherwise no phonebook access, and i've been obliged to untick " this in security settings

 

[Brock_4118]

So i have to manually disable that option in each phone ? is that any way to do that in every phone through 3cx management console or any option would be availble in 3cx console in which phone doesn't require to check valid certificate ?

 

[JohnS_3CX]

Have done same setting with same phones otherwise no phonebook access, and i've been obliged to untick " this in security settings
View attachment 11533

@ aws2p This is different, it affects what connections the PBX can accept.

In Brock's case, the phone device is the one that needs to accept the certificate. If Yealink does not support his CA in the built-in certificates then the phone will not proceed with a connection unless he disables the security (Accept All Certificates).

@Brock_4118 you will either have to choose a CA that your phones accept, or if you are OK with using 3CX FQDN, we integrate Let's Encrypt that Yealink accepts

 

[Brock_4118]

Changing CA won't be possible for me now as i have bought SSL for 2 years.
Using 3CX FQDN option how does that work ? what do i have to change for this ?
Sorry i know this thread is getting longer but i really wish i can have best & easiest way to solve this.

 

[JohnS_3CX]

When using a 3CX FQDN, we provide to you as part of your license, and we also generate SSL certificates for you via Let's Encrypt CA. These are also updated automatically before they expire so it's one less thing for you to manage and makes things easier. https://www.3cx.com/docs/fqdn-management-allocation/

To this you need to do the following:

1. release your current FQDN from your 3CX customer portal
2. Backup your existing PBX without choosing the " License Key Information, FQDN & Conference "
3. Uninstall your PBX
4. Reinstall the PBX using the "Restore Backup" option
5. You will now have the option to pick a 3CX FQDN
6. Complete the installation and proceed to reset and reprovision all phones

I recommend starting a new thread if you want more information specifically on this subject or any possible matters that you need to take into consideration.