3CX Debian Yaelink Godaddy Self-Hosted Intermediate Certificate Fix

[twyant]

First post, be gentle. I'm new to 3CX but not new to VoIP. I've seen a handful of posts on this so I figured I'd try to put all of the information here and hopefully people find it useful.

We're using GoDaddy certs and Yaelink phones for our installs. The phones don't provision over https without doing this:

Go grab the GoDaddy intermediate cert from here: https://ssl-ccp.godaddy.com/repository?origin=CALLISTO

Download the PEM for the one named GoDaddy Secure Server Certificate (Intermediate Certificate) - G2. This is the second cert listed and the name is gdig2.crt.pem.

Open the file in notepad and CTRL-A, CTRL-C.

SSH into your Debian 3CX server and cd to this directory: /var/lib/3cxpbx/Bin/nginx/conf/Instance1

nano your cert (host.name.com-crt.pem for example) and arrow key all the way to the line under -----END CERTIFICATE-----

Right-click paste the contents of the intermediate certificate into the window and CTRL-X, Y to close and save the file. If you cat the file you'll see two certificates back to back kinda like this:

-----BEGIN CERTIFICATE-----
stuff
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
stuff
-----END CERTIFICATE-----

Restart nginx - service nginx restart

Go to the GoDaddy cert checker and enter your host name in to verify it worked: https://ssltools.godaddy.com/views/certChecker

I've got a home office and have been playing around with Direct SIP registration for a couple days. Doing the above has allowed me to provision a fresh Yaelink phone without having to disable certificate checking or uploading a certificate to it. I know all about the SBC, this was something I wanted to figure out because I've done other systems where I didn't need one and I wanted to see if SIP over TLS would actually work. Now that I've got provisioning working correctly I'll move on to that.

I hope this helps and I hope I typed it all out correctly.

Tom

 

[AWS2P]

Welcome on board,
instead of all this you describe so well, I prefer being stuck to LE cert included in 3CX and go to bed happy with no headaches.

 

[twyant]

Some of us like to host in our own datacenters.

 

[cobaltit]

The FQDN has nothing to do with where you host it.

 

[twyant]

It is my understanding that I can’t use a *.3cx.com domain if I’m not using a 3CX approved provider. If I’m not using one of the approved hosting providers I can’t use *.3cx.com domain and therefore can’t use a Let’s Encrypt certificate. According to this document (https://www.3cx.com/docs/fqdn-management-allocation/) if I use a custom FQDN I can’t use a Let’s Encrypt certificate. Am I missing something? Thanks!

 

[Saqqara]

All installations can use a *.3cx domain - has nothing to do with using an approved hosting provider.

When running the wizard, you have the option to use a 3cx.com domain or your own.

If you select the option of using your own fqdn, ssl certifcates and management is down to you - you can not use the inbuilt let's encrypt ssl management,

 

[twyant]

If I don’t use a *.3cx.com domain I can’t use a Let’s Encrypt certificate. My post was meant to help those who want to use their own domain name and a GoDaddy cert with Yaelink phones. There were a bunch of posts in the community about this but none of them had all of the information in one spot which is why I posted this.

 

[YiannisH_3CX]

Hello @twyant

Just to clarify something, you can use let's encrypt with your custom domain the same as any other certificate authority. The difference is that you will need to renew and maintain the certificates manually.

When you use a *.3cx.com domain the certificates are managed and renewed by 3CX (when your maintenance is valid).

 

[cobaltit]

Thank you for posting your steps. But the reason you don't see a guide is it's kind of an intentional hurdle. People who don't understand SSL certificates enough to install them shouldn't be messing with them in the first place. Custom FQDN/SSL is an advanced option so if you have to ask for help, you probably shouldn't be doing it. You either need to pay a 3CX partner to do it or stick with the 3CX provided setup which 'just works'. Nothing you posted is 3CX specific. The use of intermediate certificates and combining them is common and documented with every SSL certificate provider I've every purchased one from. You follow those instructions and then the 3CX instructions on using a custom FQDN and you have a working solution.