Peer certificate cannot be authenticated with known CA certificates. SoundStation IP6000 4.0.16.0515

[Jonny-L]

When trying to provision a Soundstation IP 6000 running firmware v4.0.16.0515 to Poly Lens I get the following error in the logs (level: debug).

SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK.

Is there any method to update the device certificate or a possible way to resolve this?

Thanks for your help in advance!

[SteffenBaierUK]

Hello @Jonny-L ,

welcome to the HP Poly community.

A quick community search for Peer certificate cannot finds >this<

Did you use the search and check the results? Can you share your whole log?

Best Regards

Steffen Baier

[Jonny-L]

Hi Steffen,

Thanks for your reply.

I did do some searching, there are 75 results to that query and the most relevant discussion I could find is here: Solved: SSL cert issues on Polycom VVX phones after cert. update - HP Support Community - 8983071

However, it doesn't seem to mention the SoundStation IP6000 v4.0.16.0515

The above thread talks about certificates with links to PDFs, but I couldn't find a set of steps anywhere to try to resolve the issue.

Please see the log output post restart:

10:56:41.549 10.5.6.39 local0.info 64167f0557d6|000239.505|app1 |*|03|Manual Reboot
10:56:41.551 10.5.6.39 local0.info 64167f0557d6|000239.510|app1 |*|03|Restored default configuration.
10:56:41.870 10.5.6.39 local0.info 64167f0557d6|000239.825|so |*|03|SoNcasC::procMsg: Client service shutdown complete
10:56:45.001 10.5.6.39 local0.info 64167f0557d6|000242.966|app1 |*|03|***********************************
10:56:45.004 10.5.6.39 local0.info 64167f0557d6|000242.966|app1 |*|03|WARNING: Flash config reset.
10:56:45.010 10.5.6.39 local0.info 64167f0557d6|000242.966|app1 |*|03|***********************************
10:56:45.361 10.5.6.39 local0.info 64167f0557d6|000243.325|wdog |*|03|Watchdog Expired: tSup
10:59:27.775 10.5.6.39 local0.info 64167f0557d6|000211.860|app1 |*|03|Manual Reboot
10:59:27.856 10.5.6.39 local0.info 64167f0557d6|000211.947|so |*|03|SoNcasC::procMsg: Client service shutdown complete
10:59:31.364 10.5.6.39 local0.info 64167f0557d6|000215.447|wdog |*|03|Watchdog Expired: tSup
11:02:22.109 10.5.6.39 local0.error 64167f0557d6|000219.701|copy |4|03|SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
11:02:22.118 10.5.6.39 local0.info 64167f0557d6|000219.702|cfg |*|03|Prov|Starting to update 3111-15600-001.updater.ld
11:02:22.407 10.5.6.39 local0.error 64167f0557d6|000219.998|copy |4|03|SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
11:02:22.416 10.5.6.39 local0.info 64167f0557d6|000219.998|cfg |*|03|Prov|Starting to update updater.ld
11:02:22.684 10.5.6.39 local0.error 64167f0557d6|000220.273|copy |4|03|SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
11:02:22.693 10.5.6.39 local0.error 64167f0557d6|000220.274|cfg |4|03|Prov|Provisioning failed due to curl error code:60 and respCode:0
11:02:22.976 10.5.6.39 local0.error 64167f0557d6|000220.562|copy |4|03|SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
11:02:22.984 10.5.6.39 local0.error 64167f0557d6|000220.563|cfg |4|03|Prov|Provisioning failed due to curl error code:60 and respCode:0
11:02:22.995 10.5.6.39 local0.error 64167f0557d6|000220.563|cfg |4|03|Prov|Download of master configuration file failed
11:02:23.001 10.5.6.39 local0.error 64167f0557d6|000220.563|cfg |4|03|Prov|Trying to boot from existing configuration
11:02:23.012 10.5.6.39 local0.error 64167f0557d6|000220.563|cfg |4|03|Prov|Provisioning failed
11:02:23.021 10.5.6.39 local0.info 64167f0557d6|000220.564|cfg |*|03|Prov|Finished updating configuration
11:02:23.600 10.5.6.39 local0.error 64167f0557d6|000220.910|copy |4|03|SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
11:02:23.614 10.5.6.39 local0.error 64167f0557d6|000220.910|log |4|03|UtilLogC::uploadFifoLog: upload error. protocol 0 result = -1
11:02:23.624 10.5.6.39 local0.error 64167f0557d6|000220.910|log |4|03|Failed to upload boot log on start up.
11:02:23.641 10.5.6.39 local0.error 64167f0557d6|000221.187|copy |4|03|SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
11:02:23.651 10.5.6.39 local0.error 64167f0557d6|000221.187|log |4|03|UtilLogC::uploadFifoLog: upload error. protocol 0 result = -1
11:02:38.362 10.5.6.39 local0.error 64167f0557d6|000235.953|copy |4|03|SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

Thanks again for your help with this.

[Jonny-L]

Does that debug logging level give enough detail?

Hopefully there is a solution for this, thanks again.

[SteffenBaierUK]

Hello @Jonny-L ,

welcome back to the HP Poly community.

I would suggest you check why the phone does not have a valid time.

Jan 28, 2013 Question: Time and Date flashing or unable to set NTP time correctly

Resolution: Please check => here <=

A wireshark would prove why this is not working. Is there some form of firewall with inspection in place that may add a Certificate?

I suggest you contact our Support organization in your region if you need any real support as we are all just volunteers. Details are in my Signature.

Best Regards

Steffen Baier