Yealink auto provision HTTPS not working

[s2svoip]

Ive had auto-provision working perfectly for a while but went to do a new handset and see some inconsistent results.

In Yealink MCS I have my server added as

https://me.domain.com/app/provision/

with the correct user and pass.

I have SSL setup and working fine on my fusion install, and if I navigate to the URL https://me.domain.com/app/provision/305ec44ace2e.cfg it loads up perfectly after entering the same user and pass. all seems correct. in default settings in fusion I have yealink_trust_certificates=true

However the handset wont provision, its getting the settings from yealink MCS as I can log into the handset and see them in auto provision, but it wont take the settings unless I log into the handset and change trusted certificates to false.

If I change yealink MCS to http://me.domain.com/app/provision/ it will work perfectly after a factory reboot.

Any ideas on this oddity ?

 

[s2svoip]

I dug into this more and its all to do with trusted certs, did Yealink change their RPS service so that it only accepts certs from certain trusted sources unless you upload your own to the RPS service? I used to have HTTPS provisioning working just fine, but now it wont

 

[s2svoip]

did some more digging: https://support.yealink.com/en/portal/knowledge/show?id=bab64fcca62fd012b682c533 and found the below, fusion uses lets encrypt if you use their scripts, so the below would explain inconsistent results I was seeing

Note: ISRG Root X1, Let’s Encrypt Authority X1 and Let’s Encrypt Authority X2 certificates are only applicable to SIP-T48G/T46G/T42G/T41P/T40P/T29G/T27P/T23P/T23G/T21(P) E2/T19(P)E2 IP phones running firmware version X.80.0.95 or later.

 

[gflow]

There are heaps of posts on this issue, search around the forum. Come back here if you still have issues.