Here are solutions to a few common TR-069 SSL-related issues.
The CPE does not have a time source
Some CPE devices will not validate a SSL/TLS certificate from the ACS until a time source is established. TR-069 states that devices should skip date validation of certificates if a time source is not established. However, in practice some CPE devices simple end the SSL connection. A common symptom of this problem are DNS requests to an NTP server which is not configured. To alleviate this problem, simply configure the NTP server that is being requested by the CPE:
testvar ntpServer1 220.127.116.11
testvar ntpServerName1 myNTPserver.com
Note that you may configure additional NTP servers if needed.
CPE is configured with IP address of ACS instead of domain name
Typically in SSL based configurations the CPE should be configured with an ACS URL using a domain name instead of an IP address. This allows the CPE to validate that the ACS URL matches the common name in the SSL ceritifcate for the ACS.
By default, the SSL certificate for CDRouter’s ACS uses the common name acs.cdroutertest.com. In addition, CDRouter automatically maps the domain name acs.cdroutertest.com to the acsIp address (18.104.22.168 by default). If the CPE is using strict validation then the common name in the certificate from the ACS must match the ACS URL configured on the CPE. If the CPE is using a hard coded IP address (22.214.171.124) instead of a domain name (acs.cdroutertest.com) for the ACS URL, this check will fail. A symptom of this problem is the lack of DNS lookups for acs.cdroutertest.com in the log files which indicates that the CPE is using a hard coded IP address. The solution to this problem is to configure the ACS URL on the CPE to acs.cdroutertest.com (or another domain name).
Note that if a domain name other acs.cdroutertest.com is configured on the CPE, a DNS entry MUST also be added to the CDRouter configuration file:
testvar dnsHostname1 acs.mydomainname.com
testvar dnsIp1 126.96.36.199
The root CA is not installed on the CPE
In order for the CPE to validate the ACS SSL certificate, the root CA for the CDRouter ACS must be installed on the CPE. If the root CA is not installed, the CPE will reject the SSL connection. The solution to this problem is to install the root CA or disable certificate verification.
Note that you may also use your own server certificates using the following testvars:
testvar acsCertPath /usr/share/doc/cdrouter/acs.cdroutertest.com.pem
testvar acsCaCertPath /usr/share/doc/cdrouter/acs.cdroutertest.com-ca.pem