SBC Raspberry Pi cannot connect (v18 Update 4)

[digitalworks]

I have installed a Raspberry Pi according to the instructions and cannot connect the SBC. On the same network, I installed a Windows SBC for testing, without any problems. The Raspberry Pi resolves FQDM correctly. Is Raspberry Pi no longer supported as an SBC? Can anyone help me?

 

[SteveITS]

What happens? Error message?

 

[digitalworks]

Default message that it does not find the server. We have our own FQDM with certificate. nslookup and DNS works on the PI and as I said, in the same network, for testing a Windows SBC works.

 

[SteveITS]

Can you ping your server from the Pi (assuming it's pingable)? Brainstorming...some sort of firewall restriction blocking that IP? (install Pi with a different IP??)

 

[digitalworks]

The server is pingable. Traceroute looks good.
I have read that since v18 Update 4 Raspberry Pi does not support 3cx server. Does this also apply to SBC?
This guide states:
https://www.3cx.com/docs/3cx-tunnel-session-border-controller/

Note for Raspberry Pi users: If you are not using the 3CX Debian ISO, login as the administrative user via the CLI or SSH and run this command:

wget https://downloads-global.3cx.com/downloads/sbc/3cxsbc.zip -O- | sudo bash

Does this mean that you can also use 3CX Debian ISO on the Raspberry Pi?

We used the ISO in the manual:
https://www.3cx.com/docs/installing-pbx-raspberry-pi/
There is also another command:
wget https://downloads-global.3cx.com/downloads/misc/d10pi.zip; sudo bash d10pi.zip

 

[SteveITS]

since v18 Update 4 Raspberry Pi does not support 3cx server. Does this also apply to SBC?

No, that's just 3CX itself. Per https://www.3cx.com/blog/releases/v18-update-3-final/ "3CX SBC will remain supported on Raspberry Pi devices."

I think you should be installing using the https://www.3cx.com/docs/installing-pbx-raspberry-pi/ guide. That note you referenced may be an old note?

can also use 3CX Debian ISO on the Raspberry Pi?

No it's a different OS and ARM processor.

 

[digitalworks]

I'm going to test a few more things, but I think I'll switch to an Intel NUC.
The customer works through RDS and has no servers at the site, so I need a hardware SBC.

 

[SweetAction]

Does your SSL cert have the intermediate loaded? You can check using this site: https://www.sslshopper.com/ssl-checker.html

 

[Saqqara]

As your are using your own FDQN and ssl certificate, you may have to load the intermediate and ssl certificate onto the PI

It could be an SSL certificate error

 

[digitalworks]

When I call the URL from the 3CX control panel, I don't get an error message.

But the test (https://www.sslshopper.com/ssl-checker.html) showed that Intermediate/chain certificate are not installed.

The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate. Learn more about this error. You can fix this by following Sectigo's Certificate Installation Instructions for your server platform (use these instructions for InstantSSL). Pay attention to the parts about Intermediate certificates.

If the Pi SBC can't log in because of this, why does the Windows SBC work?

Customers who are using custom domain must ensure:

1. A valid certificate covering the installations FQDN as per common certificate validation rules.  Wild cards can be used, however, wild card certificates cannot be re-used for secure SIP transport as per RFC later.
2. Necessary "Intermediate-Certificates" must be included in the Nginx web server certificate. Follow the guidelines of your certificate issuer. Generally, all certificate issuers rely on intermediate certificates. You can test your setup here: https://www.sslshopper.com/ssl-checker.html

I think I have to install the Intermediate/chain certificate first, and then continue.

 

[SteveITS]

If the Pi SBC can't log in because of this, why does the Windows SBC work?

Has anyone connected to other web sites on the Windows PC? Browsers have a "fun" (in term of diagnosing certs) feature where if the browser has downloaded the intermediate cert from another web server, the browser already has the missing cert, so will not fail. Other browsers on the same PC or on other PCs that don't already have the intermediate cert, fail. So likely the Windows PC has a copy of that cert cached.

 

[SweetAction]

When I call the URL from the 3CX control panel, I don't get an error message.

But the test (https://www.sslshopper.com/ssl-checker.html) showed that Intermediate/chain certificate are not installed.

The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate. Learn more about this error. You can fix this by following Sectigo's Certificate Installation Instructions for your server platform (use these instructions for InstantSSL). Pay attention to the parts about Intermediate certificates.

If the Pi SBC can't log in because of this, why does the Windows SBC work?

Customers who are using custom domain must ensure:

1. A valid certificate covering the installations FQDN as per common certificate validation rules.  Wild cards can be used, however, wild card certificates cannot be re-used for secure SIP transport as per RFC later.
2. Necessary "Intermediate-Certificates" must be included in the Nginx web server certificate. Follow the guidelines of your certificate issuer. Generally, all certificate issuers rely on intermediate certificates. You can test your setup here: https://www.sslshopper.com/ssl-checker.html

I think I have to install the Intermediate/chain certificate first, and then continue.

Here's the easiest way to fix that:
https://www.3cx.com/community/threads/update-renew-certificate.77468/post-356128

Yes, Windows SBCs are less strict with security then Debian as far as getting the intermediate cert from another source. Browsers mask this problem as well.