"The best business telephones in the world."

Hi Madis,

File http://downloads.snom.net/documentation/certs.crt is for SHA1 certificates, and the M215 default certificate is SHA2. Your HTTPS server should trust the Snom SHA2 root certificate (see http://wiki.snom.com/Category:HowTo:TLS#Snom_Root_CA --> Snom root CA (sha2))

Here is my apache configuration as an example:

        SSLVerifyClient require
        SSLVerifyDepth  2
        SSLCACertificateFile "/etc/ssl/crt/ca-256.crt"      ---------> File /etc/ssl/crt/ca-256.crt was downloaded from link http://downloads.snom.net/documentation/ca-256.crt.

I hope this helps.

Thanks

Catalina

Hi Madis,

I am not sure if you can add several CA files by using parameter SSLCACertificateFile. Can you try to leave only one line? 

Instead of:

  SSLCACertificateFile /etc/ssl/certs/snom_certs.crt
  SSLCACertificateFile /etc/ssl/certs/snom_ca-256.crt
  SSLCACertificateFile /etc/ssl/certs/snom_phone1-256.crt

Just leave:

  SSLCACertificateFile /etc/ssl/certs/snom_ca-256.crt

(assuming that /etc/ssl/certs/snom_ca-256.crt contains the same file as http://downloads.snom.net/documentation/ca-256.crt)

In your example you have some additional lines that could also affect this so I would also suggest to remove all the other lines and try the ones that worked for me meaning like this (just to exclude other problems):

  SSLEngine on
  SSLCACertificateFile /etc/ssl/certs/snom_ca-256.crt
  SSLVerifyClient require
  SSLVerifyDepth 2 

Thanks

Catalina

Hi Lars/Madis,

One more problem that can happen is that the M200 rejects the server certificate of your HTTPS server. For example if the HTTPS server has a self-signed certificate or a certificate signed by an unknown CA. You can create a PCAP trace on your HTTP server (with tcpdump for example) or on the M200 (under Servicing -> "Network Trace") and see who sends the TLS alert (the M200 or the server).

If the M200 is sending the TLS alert then it could be that the M200 is rejecting the server certificate. In this case, on the M200 you can add the server certificate to trust under Servicing -> Certificates -> Trusted Certificates. The uploaded certificate must be in pem format.

If the server is sending the TLS alert then it might be that it the server is rejecting the client certificate of the M200. In this case I would recommend to check with the customer support for your HTTP server.

Thanks

Catalina

Hi Madis,

I agree that option "Only accept trusted certificates" seems to not be applied in this case. I opened a bug for this (bugID VTECHDEV-88).

It is possible to automatically provision the certificate. You could have an intermediary configuration file in which you could provision the certificate first, using http (not https). The initial provisioning file would look something like this:

"
file.certificate.trusted.url = http://HTTP_SERVER_IP/cert1.pem                              <------------------------ link to the certificate
provisioning.server_address = https://HTTP_SERVER_IP/provisioningFile.cfg   <------------------------ link to the secure https provisioning file

"

 After fetching the certificate automatically, the M200 would change the provisioning link to https://HTTP_SERVER_IP/provisioningFile.cfg

Thanks

Catalina

Hi Madis,

I don't have any information about the fix yet but I asked development. I will post here as soon as I get an update.

Thanks

Catalina

Hi Madis,

In version Version 2.10.46, certificate check when provisioning is done indifferent of setting 'Only accept trusted certificates' and cannot be disabled.

This is planned to be fixed in the next release in order to enable users to disable the certificate check.

Thanks

Catalina