Yealink T58A phones download a CA certificate even when disabled

I think you're misinterpreting what Disabled means on this screen.

The first setting is for Only Accept Trusted Certificates. The wording is the key here, it says nothing about refusing all certificates.

Straight from the T48S admin guide with respect to that setting:

• If Enabled is selected, the IP phone will verify the server certificate based on the trusted certificates list. Only when the authentication succeeds, the IP phone will trust the server.
• If Disabled is selected, the IP phone will trust the server no matter whether the certificate received from the server is valid or not.

The second setting where you chose Disabled is Common Name Validation. This just gets into whether or not it will validate the Common Name on the certificate. Since you chose Disabled, it will simply skip the step of validating the Common Name.

From the admin guide for the T48S:

• If Enabled is selected, the IP phone will verify the CommonName or subjectAltName of the server certificate.
• If Disabled is selected, the IP phone will not verify the CommonName or subjectAltName of the server certificate

Have you looked at the certificate getting downloaded? Is it even the right one? And also look at where it would be downloading the certificate from. Should that certificate be there?

Here I have a more graphic example, when I run Skype for Business on my computer this question appears on the certificate, I press connect and Skype connects to the server and everything works normal.


When I want to sign in on SfB's desktop phone, the certificate appears automatically and does not allow me to sign in and says registration failed, but if I delete the certificate everything works fine.

Please see the pictures.
skype_windows.png
skype_phone.png