D345 not using pnp_server

We are using the pnpserv script to provide the settings URL for new SNOM phones.

The phone is sending the SIP request message and our pnpserv script responses with OK and a second NOTIFY message with the URL.

The phone is getting the response and the pnp_server settings is correctly set.

But the phone is not requesting the settings from this URL.

How can we provision new phones without manually set the settings_server via the WebGUI on the phone?

SIP Messages

SIP/2.0 200 OK
Via: SIP/2.0/UDP 192.168.151.25:51971
Contact: <sip:192.168.150.248:5060>
To: <sip:MAC%3a000413A16161@domain.com>;tag=pnpserv
From: <sip:MAC%3a000413A16161@domain.com>;tag=1314912836
Call-ID: 801582578@192.168.151.25
CSeq: 1 SUBSCRIBE
Expires: 60
Content-Length: 0


NOTIFY sip:192.168.151.25:51971 SIP/2.0
Via: SIP/2.0/UDP 192.168.150.248:5060;rport
Max-Forwards: 20
Contact: <sip:192.168.150.248:5060>
From: <sip:MAC%3a000413A16161@domain.com>;tag=pnpserv
To: <sip:MAC%3a000413A16161@domain.com>;tag=1314912836
Call-ID: 801582578@192.168.151.25
CSeq: 1 NOTIFY
Content-Type: application/url
Subscription-State: terminated;reason=timeout
Event: ua-profile
Content-Length: 57

http://domain.com/provisioning/snom/{mac}

Settings on the phone:

setting_server=https://provisioning.snom.com/snomD345/{mac}.htm
pnp_config=on
pnp_server=http://einfachrufen.moll-group.eu/provisioning/snom/{mac}
provisioning_order=redirection:stop pnp:stop dhcp:stop tr69:stop
update_policy=settings_only
settings_refresh_timer=0
allow_sip_settings=off