Solved Provision Yealink T46G on V16 3CX, help.

[ElementalWindX]

Trying to follow these instruction but they seem very dated: https://www.3cx.com/sip-phones/yealink-t4-series/

I even went into the phone's web gui and went to settings -> autoprovision -> and filled in the server URL https://my.domain.com/provisioning/randomlettersandnumbers. That I was provided by 3xc. I have it setup with STUN as it will be a "remote" phone since this server is in the cloud.

Whenever I reboot the phone, it says "Update skipped."

Any idea where I can go to figure out what caused that?

It's on the newest .60 firmware. I've unchecked "disallow remote" in that extensions settings too.

Thanks.

 

[ElementalWindX]

It appears to be related to the SSL cert I guess? I used AlphaSSL. Trying to figure out if it's on the trusted list by yealink. Thought it was.

 

[revilo951]

Does your firewall check complete successfully?

 

[accentlogic]

I don't believe the AlphaSSL certi is included in your Yealink phones. See http://support.yealink.com/faq/faqInfo?id=691 for a list of trusted certificates. The firmwares mentioned are older, but I don't think they have updated the certs since v81.

At least do a manual firmware update on the phone, and try it again.

If you cannot install a trusted certificate on your PBX I would recommend getting a 3CX FQDN so they can handle a Let's Encrypt cert for you.

 

[ElementalWindX]

I've tried Alpha SSL, Comodo (that ended up being "Sectigo RSA"), and now Rapid SSL which actually shows up as Rapid SSL thru Digicert, which both Rapid SSL and Digicert show up on the trusted list for Yealink.

It still tells me it skips the update and won't push the config to the phone. If I turn off "Only accept Trusted Certificates" it pushes the config and the phone works perfectly.

I've verified I am changing the cert fine as I restart the nginx server every time, and incognito browser shows the updated SSL just fine.

I am using a wildcard cert, but that should be fine I imagine.

So no idea whats up

 

[ElementalWindX]

Yes the firewall checks are all green.

This is in the boot log from the phone:


<131>Sep 30 08:09:57 ATP [1278]: DURL<3+error > [DCMN]download common error, errcode:60.
<131>Sep 30 08:09:57 ATP [1278]: ATP <3+error > https to file failed, code = -160, msg = , retry = 1
<131>Sep 30 08:09:57 ATP [1278]: DURL<3+error > [DCMN]download common error, errcode:60.
<131>Sep 30 08:09:57 ATP [1278]: ATP <3+error > https to file failed, code = -160, msg = , retry = 1
<131>Sep 30 08:09:58 ATP [1278]: DURL<3+error > [DCMN]download common error, errcode:60.
<131>Sep 30 08:09:58 ATP [1278]: ATP <3+error > https to file failed, code = -160, msg = , retry = 1
<131>Sep 30 08:09:58 ATP [1278]: DURL<3+error > [DCMN]download common error, errcode:60.
<131>Sep 30 08:09:58 ATP [1278]: ATP <3+error > https to file failed, code = -160, msg = , retry = 1\


Changed the logs to level 6 and got this...

<134>Sep 30 08:22:24 ATP [1271]: DURL<6+info > [DCMN]CURL Info: TLSv1.2 (IN), TLS handshake, Server hello (2):
<134>Sep 30 08:22:24 ATP [1271]: DURL<6+info > [DCMN]CURL Info: TLSv1.2 (IN), TLS handshake, Certificate (11):
<134>Sep 30 08:22:24 ATP [1271]: DURL<6+info > [DCMN]CURL Info: TLSv1.2 (OUT), TLS alert, Server hello (2):
<134>Sep 30 08:22:24 ATP [1271]: DURL<6+info > [DCMN]CURL Info: SSL certificate problem: unable to get local issuer certificate
<134>Sep 30 08:22:24 ATP [1271]: DURL<6+info > [DCMN]Connect is short Cleanup curl.
<131>Sep 30 08:22:24 ATP [1271]: DURL<3+error > [DCMN]download common error, errcode:60.
<134>Sep 30 08:22:24 ATP [1271]: DURL<6+info > [DCMN]download common error, remove file.
<131>Sep 30 08:22:24 ATP [1271]: ATP <3+error > https to file failed, code = -160, msg = , retry = 1

 

[ElementalWindX]

All 3 certs I tried were DV wildcard certs from ssl2buy.com . Does anyone know where I can buy a wildcard SSL that simply just works with yealink? You'd think after 3 attempts at $100+ a piece, one might work.

 

[ElementalWindX]

nvm. apparently this was the issue https://www.3cx.com/community/threads/3cx-removes-intermediate-certificate-from-ssl.45167/ All solved.

 

[JohnS_3CX]

Hi @ElementalWindX

I think the information you were looking for was here: https://www.3cx.com/docs/fqdn-ssl-certificate-v15/

But please note for future use, that wildcard certs cannot be used if you plan on deploying SIP TLS