Solved 3CX Failed Certificate Renewal

[Bas Gubbels]

Hi Members,

We are using 3CX v16 (Active/Passive) setup and using the 3CX provided FQDN and certificate.
Upon the automatic renewal of the 3CX certificate we get the following error (have had multiple of those now):

HTTPS Certificate renewal Failed - Error:
IpUpdater.FqdnGenerationException: Error creating FQDN: Unexpected error : {
"type": "urn:acme:error:badNonce",
"detail": "JWS has invalid anti-replay nonce iY9-VSr2fUVmRZMqE7uKYPzNqNz1G2DywQO2pzt5oA0",
"status": 400
} ; LetsEncrypt: The remote server returned an error: (400) Bad Request.
at PostInstall.CertificateHelper.ProcessCertificatesDirectory(String directory, Boolean temporaryCertificateGenerated, Int32 regenerateNotSelfSignedCertificatesFrom, Int32 regenerateNotSelfSignedCertificatesTo, CloudServerStatus statuses, Int32 regenerateCertificateExiredInDays, String appBin, UInt16 sipPort, UInt16 tunnelPort, Boolean isPassiveFailoverMode)
at PostInstall.CertificateHelper.RenewCertificates(String appBin, String nginxConfigFolder, String configurationPath)

Does anyone have an idea on how to troubleshoot this issue?

 

[AWS2P]

Hi,
already had seen post on same problem, just have to wait to have renewal working, don't know who is the failure side originator .

 

[StefanW]

in most cases this is just a timing thing, we update the nonce in the DNS to authorize a cert update from the PBX. however, Lets Encrypt might see still an old nonce in the DNS and it then fails with the above message. It is not critical as it will be retried in 24h again and then it shall be okey.

 

[Bas Gubbels]

in most cases this is just a timing thing, we update the nonce in the DNS to authorize a cert update from the PBX. however, Lets Encrypt might see still an old nonce in the DNS and it then fails with the above message. It is not critical as it will be retried in 24h again and then it shall be okey.

Thank you for your reply, we will wait and see what happens the next few days.

 

[Bas Gubbels]

Last night we had a succesful renewal.
Thread can be closed.