Solved Snom can be provisioning by SBC or STUN

[danfw]

I have a snom D120 I'd try to provisioning by

SBC: always remains in bold (Phones)
even I tried typing autoaprovisioning link for SBC info setting URL
but nothing happened,
not at phone
not at extension


STUN:
y type autoaprovisioning link for STUN info setting URL
3CX events says that was successfully, but nothing happens
at phone
or at extension

when I re-start the phone manually
type extension number as username
ask for Register; install guide doesn't say nothing about it; but I type FQDN
type PIN voicemail as password




I think is maybe issue in firmware; a couple weeks ago I login this phone via SBC and STUN and works fine, but today doesnt works; I tried on two locations and two diferentes instanced twice in 3CX Hosted

• 3CX Version, 18.0 Update 1 (Build 226)Version
• 3CX hosted
• snomD120-SIP 10.1.54.16
• Provisioning Method: I'd tried by STUN and SBC
• Trunk Provider Net2phone
• Has the Firewall Checker passed: YES, I running Firewall check today
• Are custom Phone Templates being used: YES / NO ?

 

[cmp1]

3CX Domain or custom?

 

[danfw]

3CX Domain
also, phone always shows

redirection provisioning....

 

[danfw]

i see log in Phone and give this

Oct 1 08:04:58.908 [ALERT ] WEBCLIENT: request https://xxxxxxxxxxxxxx:443/provisioning/YYYYYYYYY/XXXXXXXXXXXXXXX stopped due to no response from server for con_id:1; resending with timeout 455936 ms


repeat this several times

 

[cmp1]

i see log in Phone and give this

Oct 1 08:04:58.908 [ALERT ] WEBCLIENT: request <REDACTED>stopped due to no response from server for con_id:1; resending with timeout 455936 ms


repeat this several times

Edit your post above to remove the URL please. It allows to download and see uid/password for your extension.

 

[cmp1]

I wonder if this is the LE Cert issue as well.
Remove the ISRG Root X1 cert from the chain if you can, restart the NGINX service and test again.

It'll be the 3rd cert in the chain, but verify with a decoder.
see my comment here for little more info.
https://www.3cx.com/community/threads/sips-inbound-from-flowroute-stopped-working.84604/

 

[danfw]

Edit your post above to remove the URL please. It allows to download and see uid/password for your extension.

thanks

I didnt find how to edit post

but I deleted link, it is no longer available, thanks

 

[cmp1]

thanks

I didnt find how to edit post

but I deleted link, it is no longer available, thanks

No worried, I had reported your post to have a mod edit the post to remove it, for your protection.
Make sure to change that extensions credentials.

 

[danfw]

No worried, I had reported your post to have a mod edit the post to remove it, for your protection.
Make sure to change that extensions credentials.

Yes I did it

Thaks

 

[danfw]

I deleted ISRG Root X1 and restart NGINX but remains at non-autoaprovisioning

in fact, is weird because this phone on September 23 works very well
I'd attached via SBC and STUN in two different instances

but last week on Thursday, September 30; doesn't work
not SBC
not STUN

even we tried at 3 different instances

 

[cmp1]

If you've modified the enai......mx box you had linked above, it's still sending the full 3 cert chain.

make the change, restart NGINX, then test my running an ssl cert checker.
https://www.3cx.com/community/threads/certificate-error-yealink.84628/page-2#post-396507

 

[danfw]

I deleted 3 cert, but doesnt works and I type it again

I just deleted again and this time I check SSL Server test ,but still give me then third cert.

I restart all services even I REBOOT instance and remains with 3 certs

This is the link with result
https://www.ssllabs.com/ssltest/analyze.html?d=enaitech.my3cx.mx&s=143.110.144.24


and I have a question, only say YES to TLS 1.2

 

[cmp1]

Where are you deleting the cert from? What files are you touching?

 

[cobaltit]

It's 3CX hosted, he can't touch the nginx config

 

[danfw]

right here

 

[danfw]

but, today after 12 hours, 3rd cert is gone.

The phone can now be auto-provisioning


But the cuestion for you sensei is:

Why?

why this 3rd Cert affects provisioning??

 

[JohnS_3CX]

Hi Dan,

There are two versions actually for the ISRG Root X1

a) The self-signed one (the phone can validate this)
b) The cross signed one (the phone no longer can validate this)

If you simply remove it, the phone follows path a) which works.

Previously the one on your system was b) which cannot be validated after September 30th. There is a hotfix that takes care of this for you, as well as a nice explanation here:
https://www.3cx.com/blog/releases/lets-encrypt-expiration/