There's no valid Domain certificate/key for SIP domain

[forrestdean]

I was looking through my Activity log and noticed I was getting a message that occurs occasionally saying "There's no valid Domain certificate/key for SIP domain xxx.xxxxxx.xx.com. I have just set up this new phone system about a week or so ago, and everything is working fine. All calls both inside and outside are working. All phones and softphones are working great so far.

So, should I be concerned about this message? Will this cause a problem later on that I haven't discovered yet?

The only issues I am having with the phones right now is that the contacts I add under Advanced > Contacts section do not show up on my Yealink phones. All the extensions show up just fine in the 3CX Phonebook, but no contacts are shown anywhere on the phone's directory. Also, there are always 11 "None" contacts at the top of the list within the 3CX Phonebook listing. I have to always scroll down 2 pages before I get to the list of extensions. I even edited the .xml file and removed the blank entries from the top, and that fixed the problem, but whenever I add any new extensions and update the phonebook on the Yealink phone the "None" contacts come right back.

The other issue I'm having is whenever I do a firewall check I always get one or two ports that fail on the 3CX Media Server test whenever it tests all the ports from 9000 to 10998. All the rest of the media server ports will pass. The SIP Server and Tunneling Proxy test always pass as well.

Is it possible this invalid domain certificate might have something to do with this?

 

[forrestdean]

Update: I just figured out why I had 11 "None" contacts at the top of the 3CX Phonebook list. I counted the number of contacts I had created and there were 11. Apparently, they must have not been entered correctly. Since they were just company contacts I didn't fill in the First and Last name. I'm not sure if that caused the contact to show up as None, but I deleted all the contacts and recreated one and made sure I filled in the First and Last name and now it shows up on my phone.

So obviously that part was not related to the invalid domain certificate message. I still get glitchy responses on the firewall check, but it doesn't seem to affect anything.

So back to my original question. Should I be concerned about this "There's no valid Domain certificate/key for SIP domain" message that shows up in my activity log, or is it just an insignificant FYI?

 

[cobaltit]

Is 5061 TCP forward to your 3CX instance/open to the world? If so, try closing that.

 

[forrestdean]

No, 5061 TCP is limited only to the 3CX server.

 

[cobaltit]

No, 5061 TCP is limited only to the 3CX server.

Do you mean your SIP provider?

 

[forrestdean]

Ok, so I checked my firewall security policy and 5061 was open. I just removed the 5061 policy and I still get the invalid domain certificate message in my activity log. I'm wondering if the message is even significant. The https web interface comes up fine and any or all secure connections are working. Maybe the message in the activity log doesn't mean anything?

 

[cobaltit]

I hadn't seen it before so my thought was something was probing 5061 (SIP TLS) and generating that message. I don't have 5061 open on any installs because TLS just isn't a thing for 3CX just yet unless you really like pulling your hair out. Perhaps you can post a snip of that message from the activity or event log (wherever it's showing up).

@JohnS_3CX

Can you confirm what scenario might trigger that message/log entry?

 

[JohnS_3CX]

By SIP domain I assume your PBX FQDN. I speculate there may have been a delay with the nginx service reading the certificate from boot (errors can show on the activity log that may be false positives sometimes). Since there is no current issue with the certificate, as well as the PBX I would ignore it for now.

 

[forrestdean]

That makes sense. I've noticed just recently that I seem to only get the message after I reboot the server, so the delay in the nginx service starting up is most likely the cause. I just wanted to make sure that I wasn't ignoring a potential problem later on. Thanks to everyone for the replies.