Provisioning Issue with Polycom IP phones

[chrism_ctai]

Hi,

We have a collection of about 15 old Polycom VVX 411's. They've all been reset as they were previously attached to another system but reset now.
If we could use these in 3CX this would be ideal, as this saves us having to buy a bunch of new Snom phones (we have one at the moment).

I am however getting issues with Provisioning, getting this log.
'SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed'

I did see a post talking about removing some certificate from our server but I didn't think that was applicable to us. The PBX is using ZeroSSL.
It seems to fail to download configuration files and what not, however some things still work:

- I can dial the extension the phone is running on and it will ring, but it is unable to answer.
- I can dial out and this works as normal if it had worked, but many functions will not like holding the line, etc.
- It seems to get the status of the extension and will appear in 3CX.

Any help would be appreciated!

 

[TheodorosG_3CX]

Your issue is related with the custom certificate. Note that vendors do not allow all the certificate authorities. This has to be clarified with Polycom however we suggest to always use a 3CX FQDN to avoid those issues.

 

[chrism_ctai]

We've managed to fix this issue by changing the certificate. If anyone else gets this issue and must use their own FQDN, try the following:

SSH into the PBX and create a new certificate using certbot. You'll have to add and install the Debian repo temporarily
(deb http://deb.debian.org/debian/ buster main) and then install certbot:
sudo apt install certbot python3-certbot-nginx, and create the certificate:
sudo certbot --nginx -d yourfqdn.com


Restarting the 3CX services and then the nginx service
sudo 3CXStopServices
sudo 3CXStartServices
sudo nginx -t
sudo systemctl restart nginx

This made my FQDN use Let's Encrypt like the 3CX FQDNs and this allowed the phone to provision.