I can't upgrade spa504g to 7.6.2SR7

[hariskar]

The file is bin and not exe like in other upgrades.

With Upgrade Enable: yes I added an upgrade rule: https://www.mysite.com/spa50x-30x-7-6-2g.bin

I save all changes but after reboot no update starts...

[Dan Lukes]

You disclosed no phone configuration details, no phone debug/log messages captured, no log from HTTPS server side, no packet dump ...

In short just nothing. No chance to help you.

I can do just blind shots.

• I assume you has read RELEASE NOTES.
• Your current phone firmware is suitable to be upgraded?
• Has been the certificate used on www.mysite.com issued by a certificate authority considered trusted by phone?
• Is www.mysite.com reachable with no SNI ?
• Are TLS (protocol, ciphersuites, ...) compatible on phone and server
• ...

And just blind shot advice - forget https (no offense, it seems you are not so skilled network administrator), use just plain http instead.

[hariskar]

Sorry for my totally incomplete post..

• Yes, I have read the release notes.
• Current firmware is 7.6.2f
• The cerificate of my site is from Let's Encrypt Authority X3
• I don't know
• I don't know

I am not skilled at all as a network administrator because I am not a network administrator, my job has nothing to do with that..

Could I put the .bin locally in my PC or the local network?

[hariskar]

delete

[Dan Lukes]

The cerificate of my site is from Let's Encrypt Authority X3

Hit!

It's not considered trusted by phone. Use just http (no https) instead. Firmware is internally signed, so it's not security risk of any kind.

I am not a network administrator

Consider to ask your local network administrator for help. But with http it will work with no help necessary.

[hariskar]

delete

[hariskar]

Thank you for reply!

I have already tried with http with no success. Phone shows an upgrading message for 2-3 and then the message goes away and it returns to normal.

http://www (dot) mikroviologos (dot) gr/spa50x-30x-7-6-2g.bin

I also tried with my ftp server like ftp://user:pass@server.server.gr/mikroviologos (dot) gr/www/spa50x-30x-7-6-2g.bin with no success.

Is there any other suggestion besides my website or my ftp server?

[Dan Lukes]

Use anonymous access for ftp (no authentication possible with SPA5xx). But if http doesn't work, then we need logs. Turn on syslog&debug messages (highest level possible) and catch them. It can be captured by a syslog server or by generic packet catcher (like WireShark). If you can, ask a local network administrator (or someone familiar with networking basics) for help.

See Debug and syslog Messages from the SPA3xx, SPA5xxG, SPA9xx, & WIP310 IP Phones

[hariskar]

I enabled all debug and syslog options and cached this withWireshark when I added the http url of my site and clicked on "Submit All Changes". The IP of my phone is 192.168.1.10 and of debud/syslog server 192.168.1.2.

[Dan Lukes · Accepted solution]

Note: detailed log from previous comment has been deleted because of sensitive information. This comment contains anonymized excerpt from it.

Next time - limit logged data to source IP of the phone in question only (Wireshark filter: ip.addr == 192.168.1.10) and save captured data to a .pcapng file. Attach it here. It's better than text copy&paste.

But for now, the text is enough and I filtered required data by self:

261 5.253704 192.168.1.10 192.168.1.2 Syslog 83 LOCAL0.INFO: [FPRV] Upgrade status flags cleared
283 5.543961 192.168.1.10 192.168.1.2 Syslog 125 LOCAL3.DEBUG: fprv_eval_upgrade_rule http www.[deleted].gr 80 /spa50x-30x-7-6-2g.bin
295 6.117888 192.168.1.10 192.168.1.2 Syslog 123 LOCAL3.DEBUG: FPRV >>>> about to try upgrade http A.B.C.D 80 /spa50x-30x-7-6-2g.bin
300 6.124014 192.168.1.10 192.168.1.2 Syslog 92 LOCAL0.INFO: Allocating 4719104 bytes for upgrade buffer.
302 6.126415 192.168.1.10 192.168.1.2 Syslog 141 LOCAL0.INFO: SPA504G xx:xx:xx:xx:xx:xx -- Requesting upgrade http://A.B.C.D:80/spa50x-30x-7-6-2g.bin
303 6.127688 192.168.1.10 192.168.1.2 Syslog 75 LOCAL3.DEBUG: FMM >>>> Requesting upgrade
304 6.128433 192.168.1.10 192.168.1.2 Syslog 104 LOCAL3.DEBUG: [create_tcp_netstrm1] use async to create tcp connection
312 6.279564 192.168.1.10 192.168.1.2 Syslog 63 LOCAL3.DEBUG: connect succeed
315 6.280261 192.168.1.10 192.168.1.2 Syslog 85 LOCAL3.DEBUG: [create_tcp_netstrm1] connect SUCCEED
316 6.281685 192.168.1.10 192.168.1.2 Syslog 75 LOCAL3.DEBUG: http method option is POST.
327 6.340073 192.168.1.10 192.168.1.2 Syslog 119 LOCAL3.DEBUG: parsing www.[deleted].gr/spa50x-30x-7-6-2g.bin in redirect request.
328 6.340498 192.168.1.10 192.168.1.2 Syslog 103 LOCAL3.DEBUG: servername is www.[deleted].gr in redirect request.
329 6.341949 192.168.1.10 192.168.1.2 Syslog 168 LOCAL3.DEBUG: servername is www.[deleted].gr, path is /spa50x-30x-7-6-2g.bin,port is 80, ip is A.B.C.D in redirect request.
330 6.342352 192.168.1.10 192.168.1.2 Syslog 104 LOCAL3.DEBUG: [create_tcp_netstrm1] use async to create tcp connection
337 6.493619 192.168.1.10 192.168.1.2 Syslog 63 LOCAL3.DEBUG: connect succeed
338 6.494151 192.168.1.10 192.168.1.2 Syslog 85 LOCAL3.DEBUG: [create_tcp_netstrm1] connect SUCCEED
339 6.556585 192.168.1.10 192.168.1.2 Syslog 76 LOCAL3.DEBUG: create ssl connection failed
340 6.559866 192.168.1.10 192.168.1.2 Syslog 108 LOCAL0.INFO: SPA504G xx:xx:xx:xx:xx:xx -- Upgrade failed: http_get failed
342 6.560617 192.168.1.10 192.168.1.2 Syslog 71 LOCAL3.DEBUG: FMM >>>> Failed upgrade

Phone is trying to fetch firmware from http://www.[deleted].gr/spa50x-30x-7-6-2g.bin. Connection is successful (message 315) but server doesn't serve the file, it asks for redirect instead. Unfortunately, log doesn't disclose the new target URL. So I did the request by self and server's response is:

HTTP/1.1 301 Moved Permanently
Location: https://www.[deleted].gr/spa50x-30x-7-6-2g.bin

Server is redirecting to https. Phone is trying the new destination, but it fail to establish ssl connection (message 339). I assume the same reason - certificate used by server ha snot been issued by trusted authority.

You need to download firmware from http server, not the https one. Obviously, http server redirecting to https is not solution.

[hariskar]

Thanks a lot! I upgraded both my phones!

[Dan Lukes]

Glad to hear you solved it.

[hariskar]

OK, I will use the filter next time. Could you please delete my pasted log?

Thanks a lot again!

[Dan Lukes]

I can't edit your comments, you need to edit them by self (it seems you did it already). I edited my comments not to contains sensitive information.

[hariskar]

Great, thanks a lot!