HTTPS Provisioning failure on P Series

This is similar to a previous post but focuses to a single issue. I also tryed to open a support ticket (it’s included for the Sangoma phones, right?) but I have issue logging in at help.sangoma.com.

I used HTTPS provisioning for the initial deployment of a few Sangoma P-Series phones. Now, it no longer works.

More details follow:

  • The FreePBX server now has a couple of ZeroSSL free certificates for multiple DNS names. Each certificate includes both names as Subject Alternative Names (SANs). The certificates contain the full chain and are trusted by browsers. I also tried switching between the two certificates.
  • I switched to the TCP channel for provisioning the P330, performed a factory reset, and the phone was able to register and get its extension configuration. However, it still does not fully provision—for example, BLF settings are missing.
  • The BLF XML file is correctly generated, and I can successfully download it via HTTPS in a browser or with cURL without certificate warnings.
  • The phone are in the same VLAN of the FreePBX, no external firewall involved.
  • Provisioning protocol is setup as https on non-standard port selected via System Admin commercial module, with credentials.

The FreePBX 17 server is fully updated now (Jul 2025) and also the phone firmware is updated (4_26_1).

HTTPS provisioning was working at the beginning of the year, but had not been used again until recently.

Did you get this resolved?

Hi @unlikely
There are no known issues with this. We are able to provision PX phones via HTTPS, and even the BLF keys are successfully loaded to the phone.

Can you clarify the exact issue you’re facing with BLF?

  • Are the BLF keys not being loaded to the phone?
  • Are the BLF keys loaded but not displaying?
  • Are the BLF key files (exten-1-blf.xml and exten-1.xml) not being downloaded?

You can check the logs on a v17 system — they are stored at:
/var/log/apache2/other_vhosts_access.log

I was waiting for a reply, it’s few weeks it’s not working anymore

There is a way to inspect what the phone is doing during provisiong and what is failing?
I see question marks on the phone (P370) instead of BLF

Hello, the device appears not to initiate any download from the provisioning web server. Could you advise on the next steps?

Hello, what to check now?

Hi @unlikely
Not sure what’s wrong with your setup. Could you please raise a support ticket, and we will try to log in to the system to dig further?

How? as I wrote I have issue logging in…

Today I performed a packet capture to analyze the HTTPS provisioning behavior between a Sangoma P-Series phone and the FreePBX server. The provisioning is configured on a non-standard HTTPS port.

The capture confirms that the phone initiates a TCP handshake with the server: SYN → SYN-ACK → ACK. However, no TLS traffic follows. Specifically, there is no Client Hello, no certificate exchange, and no application data. The connection is immediately closed with FIN-ACK sequences from both sides.

This indicates that the phone opens the TCP connection but does not proceed with the TLS handshake. The same certificate is successfully used by the phone on other services and ports, which suggests that the certificate itself is not the issue.

At this stage, the TLS session is not being initiated by the phone, despite the server being reachable and responsive.

Notably, when switching the provisioning protocol in the template from HTTPS to HTTP—and re-enabling HTTP at both the port and provisioning protocol level—the phone resumes provisioning correctly. This confirms that the issue is specifically tied to HTTPS provisioning behavior.

The server certificate was replaced with a Let’s Encrypt-issued one (Issuer: E8), but the behavior remains unchanged. The phone completes the TCP handshake on port 2096, then immediately closes the connection without initiating TLS.
Firmware has since updated to version 4.27.2, with no change in behavior. Provisioning over HTTP still works when re-enabled.

A packet capture was performed directly on the router interface connected to the phone. The result confirms the same behavior: a complete TCP handshake on port 2096, followed by immediate connection closure without any TLS handshake. In parallel, TLSv1.3 traffic is correctly established on port 8443 for other Sangoma services, using the same Let’s Encrypt certificate.
This reinforces that the issue is specific to HTTPS provisioning on port 2096, not related to certificate validity or general TLS functionality.

What’s the issue? Here to help.

“We can’t log you in because of an issue with single sign-on. Contact your Salesforce admin for help.”

Please DM your email address used when making the ticket. I’ll look in to it.

Please try now.

A new test was conducted using port 1443, which is the default HTTPS provisioning port defined by FreePBX. The server is correctly configured and serves the provisioning files (5001-1.xml, 5001-1-blf.xml) without issue—confirmed via direct browser access.

The Sangoma P330 phone successfully completes the TCP handshake on port 1443, but does not initiate a TLS session. No Client Hello is observed in the packet capture, indicating that the phone does not attempt to establish a secure connection on this port, despite the certificate being valid and the content accessible.

Further tests were conducted to investigate the phone’s behavior during HTTPS provisioning.

  • The phone’s Web GUI was re-enabled by modifying the basefile template, allowing temporary access for configuration.
  • Syslog DEBUG logging was activated on the device and directed to the FreePBX server (UDP/514), though the server is not yet configured to receive or store these logs.
  • Syslog packets were captured using Wireshark, filtered by source IP and message content.
  • During HTTPS provisioning attempts, a recurring error was observed immediately after successful TCP handshake:

[1341]E/middleman: cURL Error:77 Problem with the SSL CA cert (path? access rights?)

  • This suggests the phone fails to initiate TLS due to issues accessing or validating the CA certificate, despite the server being reachable and serving valid content over HTTPS.
  • This error also appears near connections to port 8443, although in that case the phone proceeds to successfully establish a TLS session.

Additional syslog messages were captured but appear less relevant at this stage.

|18060|1986.561935|<phone>|<pbx>__|Syslog|262|USER.INFO: Sep 30 12:21:45 lisa: [ 1338]I/middleman: Sending cURL request to https://a:[email protected]:1443/5xyzxyz-1-blf.xml with body (null) and id dl117\n|
|---|---|---|---|---|---|---|
|18061|1986.561935|<phone>|<pbx>__|Syslog|166|USER.DEBUG: Sep 30 12:21:45 lisa: [ 1338]D/middleman: getFilecURL - sslInfo=Secure\n|
|18064|1986.641113|<phone>|<pbx>__|TCP|123|36996 → 1443 [SYN] Seq=0 Win=29200 Len=0 MSS=1460 TSval=118050 TSecr=0 WS=64|
|18065|1986.725791|<pbx>__|<phone>|TCP|123|1443 → 36996 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1460 TSval=2205237889 TSecr=118050 WS=128|
|18066|1986.725791|<phone>|<pbx>__|TCP|115|36996 → 1443 [ACK] Seq=1 Ack=1 Win=29248 Len=0 TSval=118058 TSecr=2205237889|
|18067|1986.769948|<phone>|<pbx>__|TCP|115|36996 → 1443 [FIN, ACK] Seq=1 Ack=1 Win=29248 Len=0 TSval=118063 TSecr=2205237889|
|18068|1986.785981|<phone>|<pbx>__|Syslog|203|USER.ERR: Sep 30 12:21:45 lisa: [ 1338]E/middleman: cURL Error:77 Problem with the SSL CA cert (path? access rights?)\n|
|18069|1986.788274|<phone>|<pbx>__|Syslog|178|USER.DEBUG: Sep 30 12:21:45 lisa: [ 1159]D/GeneralRequests: dispatch/remove request-id 'dl117'\n|
|18070|1986.788274|<phone>|<pbx>__|Syslog|304|USER.WARNING: Sep 30 12:21:45 lisa: [ 1159]W/DownloadSequence: DownloadSequence::ResponseHandler::onComplete request 'dl117' failed: '77' downloading 'https://a:[email protected]:1443/5xyzxyz-1-blf.xml'\n|
|18071|1986.788274|<phone>|<pbx>__|Syslog|221|USER.DEBUG: Sep 30 12:21:45 lisa: [ 1159]D/GeneralRequests: insert request-id 'dl118' duration-timeout 14400000 ms, progress-timeout 60 s\n|
|18072|1986.788274|<phone>|<pbx>__|Syslog|236|USER.DEBUG: Sep 30 12:21:45 lisa: [ 1339]D/middleman: dpmaFileRequest[dl118]: url https://a:[email protected]:1443/5xyzxyz-1-blf.xml\n|
|18074|1986.792307|<phone>|<pbx>__|Syslog|243|USER.INFO: Sep 30 12:21:45 lisa: [ 1165]I/pjproject:     resolver.c  Transmitting 34 bytes to NS 1 (dns:53): DNS A query for pbx.mydomain.it: Success\n|
|18075|1986.792307|<phone>|<pbx>__|Syslog|254|USER.INFO: Sep 30 12:21:45 lisa: [ 1165]I/pjproject:  sip_resolve.c  DNS AAAA record resolution failed: No answer record in the DNS response (PJLIB_UTIL_EDNSNOANSWERREC)\n|
|18076|1986.849799|<pbx>__|<phone>|TCP|115|1443 → 36996 [ACK] Seq=1 Ack=2 Win=65280 Len=0 TSval=2205238010 TSecr=118063|
|18077|1986.849799|<pbx>__|<phone>|TCP|115|1443 → 36996 [FIN, ACK] Seq=1 Ack=2 Win=65280 Len=0 TSval=2205238010 TSecr=118063|
|18078|1986.849799|<phone>|<pbx>__|TCP|115|36996 → 1443 [ACK] Seq=2 Ack=2 Win=29248 Len=0 TSval=118071 TSecr=2205238010|
|18081|1986.849799|<phone>|<pbx>__|Syslog|211|USER.INFO: Sep 30 12:21:45 lisa: [ 1165]I/pjproject:     resolver.c  Nameserver dns:53 state changed Active --> Active\n|
|18082|1986.849799|<phone>|<pbx>__|Syslog|239|USER.INFO: Sep 30 12:21:45 lisa: [ 1165]I/pjproject:   pjsua_core.c  TX 892 bytes Request msg MESSAGE/cseq=21392 (td...) to TCP <pbx>__:5060:\n|
|18085|1986.937032|<phone>|<pbx>__|Syslog|247|USER.INFO: Sep 30 12:21:45 lisa: [ 1165]I/pjproject:   pjsua_core.c  RX 408 bytes Response msg 202/MESSAGE/cseq=21392 (rd...) from TCP <pbx>__:5060:\n|
|18086|1986.937032|<phone>|<pbx>__|Syslog|315|USER.INFO: Sep 30 12:21:45 lisa: [ 1165]I/pjproject:     pjsua_im.h  Message 'hjmzhc....' delivered successfully\n|
|18088|1986.993023|<phone>|<pbx>__|Syslog|180|USER.INFO: Sep 30 12:21:46 lisa: [ 1159]I/dpcore: operator(): List of contacts to subscribe to:\n|
|18090|1986.993023|<phone>|<pbx>__|Syslog|212|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:   pjsua_pres.c  Adding buddy: sip:[email protected]:5060;transport=udp\n|
|18091|1986.993023|<phone>|<pbx>__|Syslog|168|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:   pjsua_pres.c  Buddy 0 added.\n|
|18092|1986.993023|<phone>|<pbx>__|Syslog|182|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:   pjsua_pres.c  Buddy 0: updating presence..\n|
|18093|1986.993023|<phone>|<pbx>__|Syslog|201|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:   pjsua_pres.c  Buddy 0: subscribing presence,using account 1..\n|
|18094|1986.993023|<phone>|<pbx>__|Syslog|243|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:     resolver.c  Transmitting 34 bytes to NS 1 (dns:53): DNS A query for pbx.mydomain.it: Success\n|
|18095|1986.993023|<phone>|<pbx>__|Syslog|254|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:  sip_resolve.c  DNS AAAA record resolution failed: No answer record in the DNS response (PJLIB_UTIL_EDNSNOANSWERREC)\n|
|18096|1986.993023|<phone>|<pbx>__|Syslog|194|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject: evsub0xabea375  Subscription state changed NULL --> SENT\n|
|18097|1986.993023|<phone>|<pbx>__|Syslog|235|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:   pjsua_pres.c  Dialog event subscription to sip:[email protected]:5060;transport=udp is SENT\n|
|18098|1986.993023|<phone>|<pbx>__|Syslog|173|USER.INFO: Sep 30 12:21:46 lisa: [ 1149]I/controller: Controller - Configuration is done\n|
|18099|1986.993023|<phone>|<pbx>__|Syslog|156|USER.INFO: Sep 30 12:21:46 lisa: [ 1149]I/view: Set screen 10HomeScreen\n|
|18100|1986.993023|<phone>|<pbx>__|Syslog|176|USER.DEBUG: Sep 30 12:21:46 lisa: [ 1149]D/home: updateWallpaper() - No wallpaper file found\n|
|18101|1986.993023|<phone>|<pbx>__|Syslog|166|USER.DEBUG: Sep 30 12:21:46 lisa: [ 1149]D/home: updateLogo() - No logo file found\n|
|18105|1987.042900|<phone>|<pbx>__|Syslog|243|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:   pjsua_core.c  RX 1060 bytes Request msg MESSAGE/cseq=59414 (rd...) from TCP <pbx>__:5060:\n|
|18106|1987.042900|<phone>|<pbx>__|Syslog|244|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:   pjsua_core.c  TX 378 bytes Response msg 200/MESSAGE/cseq=59414 (td...) to TCP <pbx>__:5060:\n|
|18107|1987.044995|<phone>|<pbx>__|Syslog|182|USER.DEBUG: Sep 30 12:21:46 lisa: [ 1340]D/middleman: Checking hostname. <pbx>__ - <pbx>__\n|
|18108|1987.044995|<phone>|<pbx>__|Syslog|180|USER.INFO: Sep 30 12:21:46 lisa: [ 1340]I/middleman: messageReceived responseType: HTTPResponse\n|
|18109|1987.044995|<phone>|<pbx>__|Syslog|203|USER.DEBUG: Sep 30 12:21:46 lisa: [ 1340]D/middleman: RESPONSES: Type:HTTPResponse Seq:0 ID:dl118 salt:7...\n|
|18110|1987.044995|<phone>|<pbx>__|Syslog|165|USER.INFO: Sep 30 12:21:46 lisa: [ 1340]I/middleman: RESPONSES: New handle dl118\n|
|18111|1987.044995|<phone>|<pbx>__|Syslog|148|USER.DEBUG: Sep 30 12:21:46 lisa: [ 1340]D/middleman: Finished 1\n|
|18112|1987.044995|<phone>|<pbx>__|Syslog|152|USER.DEBUG: Sep 30 12:21:46 lisa: [ 1340]D/middleman: Finished dl118\n|
|18115|1987.066256|<phone>|<pbx>__|Syslog|211|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:     resolver.c  Nameserver dns:53 state changed Active --> Active\n|
|18116|1987.066256|<phone>|<pbx>__|Syslog|241|USER.INFO: Sep 30 12:21:46 lisa: [ 1165]I/pjproject:   pjsua_core.c  TX 653 bytes Request msg SUBSCRIBE/cseq=26193 (td...) to UDP <pbx>__:5060:\n|
|18117|1987.072296|<phone>|<pbx>__|Syslog|173|USER.INFO: Sep 30 12:21:46 lisa: [ 1161]I/middleman: checkForResponses: Finalizing dl118\n|
|18118|1987.072296|<phone>|<pbx>__|Syslog|165|USER.INFO: Sep 30 12:21:46 lisa: [ 1341]I/middleman: RESPONSES: finalizing dl118\n|
|18119|1987.072296|<phone>|<pbx>__|Syslog|163|USER.INFO: Sep 30 12:21:46 lisa: [ 1341]I/middleman: RESPONSES: finalize dl118\n|
|18120|1987.072296|<phone>|<pbx>__|Syslog|170|USER.INFO: Sep 30 12:21:46 lisa: [ 1341]I/middleman: Destination: /tmp/response_dl118\n|
|18121|1987.072296|<phone>|<pbx>__|Syslog|160|USER.INFO: Sep 30 12:21:46 lisa: [ 1341]I/middleman: Decoding HTTP Response\n|
|18122|1987.072296|<phone>|<pbx>__|Syslog|151|USER.DEBUG: Sep 30 12:21:46 lisa: [ 1341]D/middleman: File Received\n|
|18123|1987.072296|<phone>|<pbx>__|Syslog|166|USER.INFO: Sep 30 12:21:46 lisa: [ 1341]I/middleman: RESPONSES: Cleaning up dl118\n|
|18124|1987.072296|<phone>|<pbx>__|Syslog|178|USER.DEBUG: Sep 30 12:21:46 lisa: [ 1159]D/GeneralRequests: dispatch/remove request-id 'dl118'\n|

Accessing the CA certificate would be something that was done locally, on the device reporting the error.