Windows Client on v16 can no longer work in Softclient mode

[oJo]

As of today the Windows Client no longer works in softphone mode. As soon as you try to switch it returns the error "Service unavailable" and switches back to CTI mode. The logs show a problem with certificate validation in the PJSIP component.

[01.10.2021 08:13:04.652][28] 08:13:04.652 tlsc143CE5B4 TLS connect() error: SSL certificate verification error (PJSIP_TLS_ECERTVERIF)

[01.10.2021 08:13:04.652][28] 08:13:04.652    tsx0B65C8CC  Failed to send Request msg REGISTER/cseq=34894 (tdta08F61060)! err=171173 (SSL certificate verification error (PJSIP_TLS_ECERTVERIF))
[01.10.2021 08:13:04.652][28] 08:13:04.652    pjsua_acc.c  ..SIP registration failed, status=503 (SSL certificate verification error (PJSIP_TLS_ECERTVERIF))

We have tried adjusting the trusted_certs.pem file, but we couldn't determine the server-side source for it. This is a critical issue that has made all of our softphone devices unusable, I am thinking it is probably related to the letsencrypt root expiry.
I don't understand why your SIP component fails to validate a valid certificate, but that seems to be happening.

 

[VasilisV_3CX]

Hi @oJo,

Have you had a look at this post? https://www.3cx.com/community/threads/windows-client-ssl.57978/

It mentions a step by step method to attempt to correct the issue. Let me know if this works for you.

 

[oJo]

Hi @oJo,

Have you had a look at this post? https://www.3cx.com/community/threads/windows-client-ssl.57978/

It mentions a step by step method to attempt to correct the issue. Let me know if this works for you.

Yes I have, but nothing there helped. We have a custom FQDN, but the certificate is a valid letsencrypt certificate I just renewed today. Everything worked flawlessly until today.

 

[Christian_B]

Look here:
https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

 

[bytebean]

I resolved this by removing the text of the 3rd certificate (root) after first confirming that it is the root DST Root CA X3 (3CX host -> Security > Security Settings > Secure SIP Tab). In my case, this was the final
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

The second certificate was the ISRG Root X1 so windows 3cx client then validated against that instead of the expired DST Root CA X3.

 

[oJo]

Well, we thought this was fixed, removing the cert worked for a bit, and then it reappeared, so we applied the hotfix, and it also fixed it for a day. That was yesterday, today the problem is back. My guess, the 3CX Server probably reloads the certs from somewhere?
I don't know what to do, every new day the server stops working for our softclients.

 

[NickD_3CX]

At this point, I would either suggest replacing the Let's Encrypt certificates with those of another CA (SSL.com maybe), at least for a test. This wouldn't require a re-install.

Alternatively, re-install 3CX using 3CX FQDN + Certs and see if the issue remains.