Communication Panel ERR_CERT_AUTHORITY_INVALID

[aldets]

Greetings,

I'm out of ideas on what am I doing wrong. I have SAP CCtr FP16, AudioCodes SBC. Problem is, that every time I login to CP I see in the Console log the following:

WebSocket connection to 'wss://[SBC_FQDN]:5067/' failed: Error in connection establishment: net::ERR_CERT_AUTHORITY_INVALID.

I went step-by-step with this note 2827956. We have our own internal Domain Controller with which we can issue certifiates (being a CA). I also issued certificates with it for ECF and RI and everything works for that.

Since our CA is giving out the certificates with ".cer" extension I converted it to ".pem" as the manual sugested. Imported the ".pem" under Certificate and "root.pem" under the "Trusted Root Certificate. Everything looks OK in SBC. Still the same error.

I set the "Bridge" in the WebRTC Trunk as Agents VU SipBridge. Second SipBridge is under PSTN VU.

Do you have any idea what might be the case? Are there some logs In SAP CCtr I can check for additional information regarding the certificate error? So far I haven't found any logs that give errors during the login time.

Kind regards,

Alder Tsvetkov

Application administrator

[former_member736352]

Hey,

It's hard to give more than guesses from this info. You could raise ticket with logs to get more.

But anyhow, some guesses:

1. quite usually what we have seen the 500 comes if you try to use wrong SIP Bridge in the system. (wrong = bridge in PSTN VU)

2. also I would check what it's saying in SIP Bridge log. (that is not in PSTN VU)

BR,
Jukka

[former_member736352]

Hey,

For me it seems that connection between browser and SBC is failing. Means that nothing is written to CCtr logs as messaging stops to SBC. Once it passes SBC you should be able to see SIP:REGISTER in agents VU SipBridge, you can filter for example with tmp* (from temp). The tmp ID is generated for each webrtc session and tmp is good identifier here. At the end a small tip for Communication Panel login and log reading..

In this case I would say that SBC do not have required cert, you could try following:

1. enable SBC trace and see what is the error there
2. wireshark things at your client and see what certificate is used for wss: connection. (browser console might reveal that as well...)

//Jukka

Simplified messaging chain when you login to Communication Panel and log lines:

[AS] New Channel from [EcfFrontEndServer]
[AS] PhoneManager: AddSipAddress: [TMP7590AC71240B59011F0053351C892]
[AS] SipHandler phone registered as TMP7590AC71240B59011F0053351C892 with ip xx.xx.xx.xx
[SIP] search with TMP****** and you can match to guid visible at AS logs

[aldets]

Hi Jukka,

Thank you for your answer. Resolved the certificate issue.

Even managed to get SAP to connect to the SBC. At first handshake failed, but fixed that aswell.

Now another error has arisen when login on to Communication Panel:
Reason: SIP ;cause=500 ;text="Classification Failure"

I believe that should be a SBC configuration error? The AudioCodes manual is more than 1100 pages long, so figuring out what I'm missing is going to take long. I've done the setup as the SAP help manual suggests, but there is alot more to take on. It looks like something is not allowing to register my SAP installation in the SBC. Atleast the SIP message doesn't have REGISTER in it's "Allow" row. All I have are those:
Allow: INVITE,ACK,CANCEL,BYE,UPDATE,MESSAGE,OPTIONS,REFER,INFO

Kind regards,

Alder