Unsupported Provisioning Snom 300 and 320 handsets over HTTPS

[NicholasBarnes]

Hi all,

Follow these instructions at your own risk!

I have a customer with a large number of Snom 300 and 320 handsets who would like to use 3CX. As you all know, once registered, the handsets work perfectly, it's the provisioning of the handsets over HTTPS that's the problem. The handsets can only provision over TLSv1 and they have a very limited number of cipher suites they can use and these don't match any of the cipher suites offered by a default 3CX installation.

As the customer has over 500 handsets, they are reluctant to throw them away and purchase new ones - both for financial and environmental reasons.

I thought I would document my journey in getting the handsets to provision from 3CX version 18 over HTTPS. Note that these instructions only work on self-hosted installations where you can get console access to the command line.

1. Upgrade to the latest firmware (https://www.3cx.com/support/phone-firmwares/).
2. Under Security --> Anti-hacking, turn off "SSL/SecureSIP Transport and Ciphers" (it's at the bottom of the page) and click OK.
3. Restart the SIP Server (Dashboard --> Services --> SIP Server --> Restart).
4. Get to the command line on the server (e.g. with SSH).
5. In the file '/var/lib/3cxpbx/Bin/nginx/conf/nginx.conf', find the line containing "ssl_ciphers' and add ":AES128-SHA" to the end of the line (but before the "';" characters).
6. Restart nginx with the command 'systemctl restart nginx'.
7. Snom 300 and 320 handsets should now provision over HTTPS (note that provisioning takes a couple of minutes because a few files are pulled from snom.com and for some reason there's a huge delay and timeouts on them).

Note that these instructions don't work with Snom 360 phones - the firmware version must be 8.7.5.35 or higher (support AES as the block cipher) and the latest Snom 360 firmware is 8.7.3.25.9. There may be a way of getting 360s to provision over HTTPS, but I didn't need to, so I haven't worked it out!

Also note that adding AES128-SHA (TLS_RSA_WITH_AES_128_CBC_SHA) weakens the security of the 3CX web server.

Nicholas.

 

[cobaltit]

As an alternative while keeping everything supported a site to site VPN would do the trick so you could provision over HTTP

 

[NicholasBarnes]

Yes, indeed and we do that for a few customers - we run Wireguard on some servers for that very reason. Bugged me, though, that for some customers this is not optimal as relying on a VPN makes a lift and shift a lot more difficult.