Equinox and certificates

[capthoward]

Hello all! I have recently upgraded a system from R9.1 to R11 and have some issues getting Equinox to recognize the certificate. Formerly, OneX was installed but never used and so the system already had the FQDN ipo.companyname.com filled in on the System>VOIP tab. I had the IT folks set up an internal DNS entry for that FQDN and I programmed a good DNS address into the IPO. I am able to connect with the equinox app and look at system contacts but I always get the red triangle of gloom that says that VoIP services are limited. I do have TLS ticked and I can browse to

https://ipo.companyname.com/46xxsettings.txt

and see that it is autogenerated.

A couple of times, I have inexplicably been able to get everything to function on my android device. On a reboot of the device though, it stops working. Any helpful pointers would be very much appreciated.

 

[derfloh]

Where does it tell you that it is a certificate issue? It can also be that port 5061 is not reachable.

IP Office remote service

https://www.fwilke.com/home

Fixed price SIP trunk configuration:

https://www.fwilke.com/en/ip-office-sip-trunk-en/

CLI based cale blocking:

https://blog.fwilke.com/ip-office-block-calls-from-specific-cli/

SCN fallback over PSTN:

https://blog.fwilke.com/ip-office-scn-fallback/

 

[capthoward]

Earlier in the process of setting all this up, the equinox app was telling me there was a problem with the certificate. If I logged into the app using http instead of https I would get invalid domain or some variation of that message. Now that I have finally successfully(I think!) installed the certificate on both a Mac and a Windows machine, I no longer am receiving a domain error or certificate error. On the Mac it says "VoIP service limited", on the windows machine it says "Network currently unavailable" and on android it says "VoIP phone service is not currently available". I am using 3 different profiles so that there's no conflict there, but all the profiles are identical with the exception of the extension and password.

My thought is that since TLS and 5061 utilize the certificate, then perhaps the issue is certificate related. If there are other avenues to investigate, then by all means hit me with them and I'll look into it!

 

[capthoward]

At some point in the past, someone had a CA generated from Let's Encrypt as well as DigiCert. Those certs are old but still valid. Could that be the issue?

 

[Pepp77]

We had some issues with Certs and Equinox when we first started using them and cae up with the following procedure that has just made it work.

Go to

https://FQDN:7071

Login

Go to Settings-->General

Scroll Down to Certificates

Click on Download (PEM-encoded)

Save this file locally.



Rename the file to WebRootCA.pem



Open putty

Connect to FQDN on port 22

Login with Administrator.



Type cd .. until at the top directory

Type cd /opt/ipoffice/system and hit enter

Type sudo chmod -R 777 primary and hit enter


Open WinSCP

Connect to FQDN on port 22

Login as Administrator

Navigate to opt/ipoffice/system/primary

Copy the newly renamed certificate into this directory.

If you don't want to chmod -R 777 then you can also copy the file across to the Primary folder using the embedded file manager.

I will be 100% honest and advise I do not know why we ended up doing this, only that it worked (we also never have to install certificates on local machines where the apps are installed).

| ACSS SME |