Update 6 Final is out - with new WebRTC softphone!

[N_G]

You have to be sure that your NFR license is still valid it requires 3CX partner status. Logon to your partner portal to find out your status.

 

[saint_]

@Nick Galea my license are still valid.
@craigreilly You are right I should have given the full version: 15.5.15502.6 <- Is this 6 the service pack ?

 

[tvdir]

yep, that's correct, you are on SP6.

 

[cobaltit]

Mostly interested about the SSL improvements, noticed this new section under Settings > Security after upgrading: SSL Transport and Ciphers, Enable PCI compliance SSL Transport and Ciphers (This will leave only TLSv1.2 enabled and may prevent old legacy phones and old 3CX Clients to connect remotely to your system). Does this apply to the desk phones or only the softphones? We're currently running Yealink T46G desk phones everywhere and they're constantly failing our PCI scans for using weak cipher suites. I'd assume this update would place the necessary bits in the T4X template, but our scans are still showing those ciphers in use.

The combination of these questions and the mention of PCI scares me...

So that checkbox enables PCI compliance for 3CX by disabling the non-compliant ciphers and transports. So yes it will apply to the desk phones, softphones, web browsers, smart light bulbs, FitBits or anything else that can make a HTTPS connection to 3CX (including your PCI scanner).

The fact that you thought a checkbox in 3CX to make 3CX PCI compliant (at least from the SSL standpoint) is a pretty big leap. Maybe if that checkbox looked like this:



3CX is not Yealink and Yealink is not 3CX. So while 3CX could be nice guys and disable ciphers via the config file (if possible) I'm pretty sure they don't want to assume any responsibility beyond their own product as far as PCI compliance.

I've never had a Yealink phone (or any other phone for that matter) fail a PCI scan. But I've also never put one in my CDE because that's just asking for trouble. Put the phones in their own segment with a stateful firewall (not just ACL) in between and your PCI scan issues are solved.