I can’t take credit for this, but I document for my own future benefit as well as for the benefit of others. A new client received a number of VVX phones which during the projects we standardized to 5.4.5 code but without a provisioning server, but that’s not important. There were no issues with authenticating the phone with the Skype for business user account (not PIN, user account). BUT when we went to test 5.5.1 firmware, the phones would not authenticate. Even phones which were already authenticated prior to the update, were no longer able to sign in.
Setting the “dhcp.option43.override.stsUri” attribute of the phone, or manually setting “DHCP Option 43 Override STS-URI” setting under Settings | Provisioning Server, DHCP Menu, to the same value in DHCP Option 43, e.g. https://sfbfe01.company.com:443/CertProv/CertProvisioningService.svc allowed the phones to perform user authentications again.
Near as I can figure, this “might” be a result of using a VLAN for the VVX and perhaps 5.5.1 code can’t properly retrieve the option 43 from DHCP, which it doesn’t have this issue 5.4.x code. This is merely speculation. Very odd.