VVX 201 | 6.4.6.2453 - HTTP TLS certificate validation

[quanic]

Hello, we are trying to figure out why VVX 201 is not capable of validate the TLS chain.

Actually, SIP works with the same certificate, but HTTP return this error:

1127181100|copy |4|00|SSL_connect error Peer certificate cannot be authenticated with known CA certificates.SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed

Other IP Phones, browser and even clis, work with that certificate.

We have this problem with or without the intermediate certificate loaded into the Poly CA Platform Store.

Are we facing an underlaying bug or we are missing somenthing really easy here?

Thanks in advance for you help,

Regards

[M_Salman]

Hello @quanic , Welcome to the HP Poly Support Community.

Thanks for reaching out about your query regarding the Poly device.

I’m sorry to hear about the issue you’re experiencing with your Poly VVX 201. I understand how important it is for your device to function properly, and I’m here to help you get this resolved. Please try the steps below and test the VVX 201 afterward.

Check the CA Certificates Installed on the Phone:

• Ensure that the CA certificate that signed the server's certificate is installed on the VVX 201. You can download the necessary CA certificates from Polycom's PKI if they are not yet installed.

Verify the Certificate Chain:

• Verify that the entire certificate chain (root and any intermediate CAs) is complete and sent by the server. Some devices require the full chain to be presented to establish trust.

Configure the Device Certificate:

• Make sure that the device is configured properly to utilize the correct certificate for HTTP transactions. This configuration can usually be done via the phone's web interface or through a provisioning server.

Update Device Firmware:

• Ensure the VVX 201 is running the latest firmware version, as updates might have improvements in certificate handling.

Certificate Validation Settings:

• Double-check the phone's settings, particularly any options related to certificate validation. Ensure that the settings align with those required to validate certificates against your PKI.

Take care and have an amazing day!

If you would like to thank us for our efforts to help you, go to the public post and give us a virtual high-five by clicking on "Yes" for the question "Was this reply helpful?" below my message, followed by clicking on the "Accept as solution" on my public post.

Regards,

Salman

[SteffenBaierUK]

Hello @quanic ,

Welcome to the HP Poly community.

From our VoIP FAQ:

Apr 17, 2013 Question: How can I setup a TLS connection for SIP signaling and / or troubleshoot this?

Resolution: Please check => here <=

Jan 19, 2012 Question: How to troubleshoot Poly VoIP-related Issues?

Resolution: Please check => here <=

Edit: You would want to try these logging levels

Settings > Logging > Global Settings > Global Log Level Limit > Log File Size (Kbytes) > Edge E, Trio 8300 & Trio 8300, Edge E or VVX after 5.5.0 = 1000
Settings > Logging > Module Log Level Limits > CURL > Event 3
Settings > Logging > Module Log Level Limits > Copy Utilities > Event 1

Best Regards

Steffen Baier