Failed to fetch the user certificate error message

[Anonymous]

Hello,

We are using O365 for Skype for Business.  We have Polycom VVX 500 phones that are used to log into the user's SfB account, to allow them to have a physical phone.  This past week, we began to have an issue when attempting to log in using the Web Sign-in option, as well as the VVX 500 admin console Settings > Skype for Business Sign In option.  When a user attempts to log in, it begins to authenticate, but it throws an error when it tries to fetch the user certificates.  The error message is "Failed to fetch the user certificate".  It sits on the screen for a while, then it cancels out.

If the user is already logged in, they do not have any problems, until the phone is logged out, and they attempt to log back in.  As I stated before, everything was working well up until about a week ago.  Any assistance you could provide with this would be appreciated.  Here is some information regarding the phones, as well as a copy of the log for one of them.

I have performed a factory reset on one of the phones, and upgraded the software back to version 5.8.0.12848, and tested it again, but receive the same error.  Also, I cannot find any solution online.

Phone Model: VVX 500

UC Software Version: 5.8.0.12848

(log attached)

[SteffenBaierUK]

Hello @NMRConsulting,

welcome to the Polycom Community.

First of all your VVX 500 was sold back in 07/09/2016 via NETXUSA but is not a Skype for Business SKU.

We explain this in the Skype for Business FAQ here:

Feb 15, 2017 Question:What is a Skype for Business / LYNC SKU / Stock Keeping Unit?

Resolution: Have a look => here <= or check the License requirement described above => here <

So the first step for us is to ensure you are holding the relevant Polycom Skype for Business licenses.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

Polycom Global Services

[Anonymous]

I am having the same issue but these are on VVX-310 series phones on our company network.  They log in if I connect on regular broadband connection like Comcast.  Are there any ports that need to be opened for the phones to fetch the certificates?  Likewise I haven't been able to find any other information elsewhere.  

[SteffenBaierUK]

Hello @ricknnova,

welcome to the Polycom Community.

Both the community's Must Read First and the community's FAQ reference the basic minimum information a new or follow up post should contain.

This ensures the questions having to be asked are limited and any new or follow up post contains the right amount of details to ensure any voluntary participant within the community does not spend additional time chasing basic information.

As a reminder the basic information asked for:

• Provide the exact Software Version of your Phone

• If applicable provide a backup of the phone in question
  
  UC Software 4.0.0 or later via the Web Interface Utilities > Phone Backup & Restore > Phone Backup > Phone Backup

• If possible provide a Log and either attach them or use the Code Tag.Consult the Troubleshooting Section found within the FAQ if applicable

• If possible provide the MAC Address or Serial of the device

• Provide details if the issue is a day 1 issue or only happened after an upgrade or any other relevant details

Whilst providing the answers to the above may not directly impact any possible answer the community can provide, it does enable Polycom to have an overview of the current software used in the field and allows us to look up potential support partners if an issue needs to come into support.

Please ensure you always check the FAQ's and/or utilize the community search before posting any new topics or follow up post’s.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

Polycom Global Services

[Anonymous]

Hello Steffen,

I appreciate your response.  So I'm a bit confused.  We purchased the phones (I believe anywhere from 15 to 20 phones) from different vendors around 2 years ago.  When they were purchased, nothing was mentioned about requiring a Polycome Skype license.  We have been using the phones since they were purchased with Skype for Business Online subscriptions without any problems, and now suddendly this certificate issue surfaced.  I don't know if we have Polycom Skype licenses for any/all of the phones.  I looked over the "have a look here" links you sent, but they really didn't provide much information on how to determine if you have a license or not.  Can you please provide some more specific instructions on how to determine if we have a license or not? Also, do the licenses expire after a certain time period or are the lifetime licenses once purchased? Lastly, is this cerificate error message that we are receiving related to t he Polycom licenses?

Thank you.

[SteffenBaierUK]

Hello @NMRConsulting,

not knowing who you purchase from or if this question was ever brought up the fact is that we are selling different phones for openSIP and LYNC / Skype.

The easiest way is to factory reset a phone and if it powers up prompting you to sign into Skype then it is either the -018 (LYNC) or the -019 (Skype for Business) SKU.

This is also documented on the box of the unit.

As mentioned in the linked post Polycom reserves the right to audit your deployment to verify that you have sufficient licenses to match the number of devices being used.

The Licenses are:

5150-49252-001	SW,LIC,LYNC ENTERPRISE IND PHONE
5150-49253-001	SW,LIC,LYNC ENTERPRISE SITE (5 UNITS)
5150-49254-001	SW,LIC,LYNC ENTERPRISE SITE (10 UNITS)
5150-49255-001	SW,LIC,LYNC ENTERPRISE SITE (100 UNITS)
5150-49256-001	SW,LIC,LYNC ENTERPRISE SITE (1000 UNITS)
5150-49257-001	SW,LIC,LYNC ENTERPRISE SITE (10000 UNITS)

If you have not been sold this separately then you must purchase these now to be covered. You can send me all your MAC addresses and I can verify the SKU you have.

The license will not expire and has nothing to do with your actual error.

Best Regards

Steffen Baier

[Anonymous]

Hi Steffen,

Thank you for clarifying that.  Here is the list of MAC addresses for the phones we use.

0004.f2c5.c9f3 3
0004.f274.5acd 11
0004.f274.64d6 100
0004.f274.6715 143
0004.f2c9.f75d 530
0004.f2c5.bc75 575
0004.f2c5.b9c7 751
0004.f2c5.b9c9 968
0004.f2c5.c82b 1054
0004.f274.ba85 1410
0004.f2c4.cbc4 1437
0004.f274.6308 2956
0004.f2c5.b9cf 13778
0004.f274.5d94 13785
6416.7f09.289b 13785

So if the certificates error message is not related to the licenses, then how can I get support to try and get this resolved?  Some of our users do not have an active phone because of this.

Thank you.

[SteffenBaierUK]

Hello @NMRConsulting,

These are the details:

0004f2c5c9f3	2200-44500-025	Veracomp SA	14/12/2015
0004f2745acd	2200-44500-001	NETXUSA	07/09/2016
0004f27464d6	2200-44500-001	NETXUSA	07/09/2016
0004f2746715	2200-44500-025	Go Telecom B.V.	25/06/2016
0004f2c9f75d	2200-46161-025	WESTCON GROUP EUROPEAN OPERATIONS LTD	15/12/2015
0004f2c5bc75	2200-44500-025	Veracomp SA	14/12/2015
0004f2c5b9c7	2200-44500-025	Veracomp SA	14/12/2015
0004f2c5b9c9	2200-44500-025	Veracomp SA	14/12/2015
0004f2c5c82b	2200-44500-025	Veracomp SA	14/12/2015
0004f274ba85	2200-44500-025	Go Telecom B.V.	25/06/2016
0004f2c4cbc4	2200-44500-025	Veracomp SA	03/12/2015
0004f2746308	2200-44500-001	NETXUSA	07/09/2016
0004f2c5b9cf	2200-44500-025	Veracomp SA	14/12/2015
0004f2745d94	2200-44500-025	Go Telecom B.V.	25/06/2016
64167f09289b	2200-44500-025	ALLNET GMBH	24/05/2017

They are from 5 different reseller so you would have 5 different people providing you with the individual licenses if you purchased these at the same time as purchasing the phones.

As none of the above are in warranty be prepared to Pay Per Incident / PPI. This is all outlined in detail here

You got two problems at present:

1. First the lack of the Skype for Business Licenses which you must purchase in order to use these Phones with the Microsoft Skype for Business Platform
   
   
2. Open a PPI Ticket as these are all out of warranty but provide proof of purchase for the Polycom Skype for Business license.

Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.

Best Regards

Steffen Baier

Polycom Global Services

[Anonymous]

I have the same issue with my VVX600 and, clearly, it was caused by the recent auto-upgrade to 5.8.0.12848C. This version seems to have a new "feature". I was able to downgrade to 5.7.2.1765E, the last-known-good firmware, and can log into Office 365 normally again.

I suggest that you downgrade (via web interface Utilities > Software Upgrade) and disable auto update, by saving the following XML snippet into a file and loading it on the Utilities > Import & Export Configuration page in the web interface: 

<?xml version="1.0" encoding="utf-8"?>
<changes>
<test device.prov.lyncDeviceUpdateEnabled.set="1" />
<test device.prov.lyncDeviceUpdateEnabled="0" />
</changes>

[Anonymous]

I pasted the wrong XML snippet in my earlier reply. This is the correct one to disable auto-update:

<?xml version="1.0" encoding="utf-8"?>
<Lync device.set="1" device.prov.lyncDeviceUpdateEnabled.set="1" device.prov.lyncDeviceUpdateEnabled="0" />

Meanwhile, with the wrong configuration file loaded into my phone, it auto-updated again, to version *.12848 (not release C) but this time I am not getting the certifiate error anymore. So maybe force-downgrading and allowing it to auto-re-upgrade is sufficient for resolving this. The firmware comes from Microsoft, btw, not the Polycom server that I normally use for firmware updates, and maybe the version there has been replaced:

144414|curl |3|00|Connected to webpooldm12a18.infra.lync.com (52.112.67.115) port 443 (#0)
1001144414|curl |3|00|successfully set certificate verify locations:
1001144414|curl |3|00| CAfile: /ffs0/ca1.crt
CApath: none
[.... TLS handshake stuff removed ....]
1001144415|curl |3|00| SSL certificate verify ok.
1001144415|curl |3|00|SSLv2, Unknown (23):
1001144415|curl |1|00|HEADER_OUT: GET /RequestHandlerExt/Files/3PIP/POLYCOM/VVX600/Rev-A/ENU/5.8.0.12848/CPE/CPE.nbt/sip.ld HTTP/1.1
...