FusionPBX Cloudflare

[bazwalt]

Hi There,

Recently I changed over to Cloudflare to add Universal Wildcard SSL to my FusionPBX set-up which I am currently labbing. My registrar is with Godaddy and I am using CF for my nameservers.

After some struggles, I've finally managed to get my Yealink handset now registering (previously it wasn't) when the proxy is enabled on CF and I can successfully get to the FusionPBX admin page using HTTPS.

I've rebooted everything and confirmed the handset is able to re-register and I can make and receive calls perfectly fine.

The issue I now face is that I cannot seem to get the auto-provisioning function to work. Previously this was all working fine before adding Clourflare SSL into the mix.

If I browse to https://<domain>/app/provision/<mac-address>.cfg it successfully shows the entire handset config within fusionpbx.

But for some reason I cannot push the config from FusionPBX onto the handset nor can I request the handset to pull the config by pushing the button in the phone GUI.

I suspect it may be something to do with https and me needing to generate something in cloudflare to add into the Yealink GUI but I'm not confident on how to do this and nothing I have tried has worked.

Any ideas?

 

[hfoster]

I'd probably try a little check if it's TLS related by disabling the the 'Only Trusted Certificates' or whatever it's called in the Yealink Security section. If it works like that, you know your problem is related to the TLS. Failing that, you may wish to perform a packet capture from the Yealink during a provisioning attempt to see what HTTP packets are being sent back and forth. Oh, and ensure your firmware is up to date.

The reason behind my thinking is that we had no end of problems with Yealinks moving over to LetsEncrypt, as the CA bundle was outdated they came shipped with.

 

[bazwalt]

I'd probably try a little check if it's TLS related by disabling the the 'Only Trusted Certificates' or whatever it's called in the Yealink Security section. If it works like that, you know your problem is related to the TLS. Failing that, you may wish to perform a packet capture from the Yealink during a provisioning attempt to see what HTTP packets are being sent back and forth. Oh, and ensure your firmware is up to date.

The reason behind my thinking is that we had no end of problems with Yealinks moving over to LetsEncrypt, as the CA bundle was outdated they came shipped with.

Ah yes, I forgot to mention I had already tried that but I suppose a firmware check could be in order. Then maybe the packet capture. Thanks!