We have this issue too, and I'm pretty sure it's because the default provisioning template for Polycom phones in v15 specifies HTTPS for the Directory file, and doesn't disable the common name checks for SSL certificates as specified as required by Polycom for wildcard certificates to work here:
https://community.polycom.com/t5/Vo...ones-support-wildcard-certificates/td-p/79702
Also, although 3CX v15 specifies the provisioning URL via HTTPS (and HTTP is disabled), the most recent "supported" 3CX Polycom firmware is 5.6.0. However, Polycom only added support for SSL/TLS 1.2 in v5.6.3, and didn't support Let's Encrypt until v5.7.3. In addition, Polycom still doesn't have an option to turn off Certificate Authority checking entirely (just common-name checking), and I haven't been able to find anywhere confirmation that the new Let's Encrypt root CA has been added.
All this means you either need to enable HTTP configuratoin download, and edit your config files to replace the HTTPS link to the directory file with HTTP, or updated your phone to a more recent firmware (that's not officially supported by 3CX), and maybe add the SSL cert to the device manually through the GUI.
There's also a place to manually disable common-name checking of SSL certs in the Polycom GUI in Settings > Network > TLS > TLS Applications, but even with this (validation unchecked) in v5.8.2 we still get SSL errors in the boot log when using a wildcard certificate.
You *can* load a custom device certificate into the Polycom inline in a configuration file, but it's a PITA:
https://community.polycom.com/t5/Vo...tificate-with-config-files-using-4/td-p/12886
It would be really nice if we could simply specify 3CX to allow HTTP config download, so that the phones could download the CA root certificate or server certificate from within the config file if needed, and then switch to HTTPS for future pulls. But, we don't even have true Line BLF features on these phones due to them being "Legacy", so I don't have high hopes.
A shame, because we run into Polycoms everywhere, and not having to replace phones is a big boon to sales.
