Phone Screenshot URL with HTTPS

[gruber]

Hi All,

I need help regarding the phone screen feature. Our product uses a built-in Cisco IP phone feature that provides the current phone screen as PNG or BMP image via HTTP access.

Phone Screen URL: http://<IP-ADDRESS>/CGI/Screenshot

Problem

This phone screen feature works fine with all types of IP phones by using HTTP protocol. However, if we switch the URL to HTTPS, this feature is unreliable. It works in some phone types but does not work with other types. As a result, we noticed an unpredictable and unreliable behaviour.

It has been also tested without our product, so we carried out tests directly with Chrome and Firefox browsers and the result was the same. It seems to be unreliable when HTTPS is used in the URL.

Assumption

Could it be an issue with the phone firmware? Perhaps some firmware versions do not support HTTPS properly?

Please look at the attached Word document (phone_screen_issue.docx) where I added pictures for both working and non-working cases.

Kind Regards,

Zoltan Balogh

[Rich R]

Hi Zoltan

For https to work reliably you need to use a public trusted https certificate.   Otherwise every single device will need the correct private CA and intermediate certificates installed.

I see your URL is http://<ip address>/ - that's an immediate red flag for me because certificates should normally only be issued for a fully qualified DNS domain name (FQDN).  So the URL should be something like https://mydomain.company.com/ resolved via DNS and the certificate (issued by a trusted CA) should exactly match that domain.  That is the starting point for reliable working https.

The other factor is different TLS versions and ciphers/hashes.  Your client and server need to support common protocols and ciphers/hashes.  If client or server is horribly out of date (for example a very old client which doesn't support TLS) then they will not be able to negotiate the TLS connection.  So you need to make sure all clients and servers are capable of supporting the latest standards - in some cases that may require software or firmware updates.  It might not be possible on old products which are end of support.