J169 says "Aquiring Service" after uploading 3rd party certificates

[AlwaysSomethin]

Even after regenerating all certificates they still get stuck on Acquiring Service. The certificates are all valid and if i turn off TLS the phones boot fine. This was working before the new certs.

 

[TheSmash]

You need to have the SIP Domain as a SAN entry in your certificate.

SIP FQDN - ipo.example.com
SIP Domain - example.com <- this needs to be a SAN entry

If you don't it won't work. Also, wildcard certs aren't supported (but there is a workaround).

The documentation also refers to having a URI or URL (SAN) entry in the format;

sip:example.com

But I'm not 100% if this is mandatory.



ACSS (SME)

 

[jamie77]

It needs to be a UCC certificate with the SAN entries as above. ours doesn't have the sip: entry and works OK for J100, Equinox, OXM etc.

We got ours from Go Daddy and work no problem.

Jamie Green

[bold]A[/bold]vaya [bold]R[/bold]egistered [bold]S[/bold]pecialist [bold]E[/bold]ngineer

 

[sroderick]

I'm curious about the wildcard "workaround". Any more info on that?

 

[TheSmash]

Sure, create a 46xxSpecials.txt file. Add this in;

SET TLSSRVRID 0

Make sure you export the PEM encoded cert from 7071, rename this to WebRootCA.pem and drop this into the system/primary folder too.

I say workaround. It's a hack and isn't secure so use at your own risk. But if you already have a wildcard this is a way to get it working with the J-Series and TLS.

ACSS (SME)

 

[janni78]

You might as well use your own CA for certs, paying for a cert doesn't make it more secure and only your own devices need to trust this CA.

"Trying is the first step to failure..." - Homer

 

[TheSmash]

I hear LetsEncrypt support is coming...

https://letsencrypt.org/

ACSS (SME)