Solved 3cx on debian -- ERR_CERT_DATE_INVALID

[stangri]

I've installed 3cx on debian quite a few months ago and when I hit the roadblock with outbound rules I just put migration on hold. I was ready to give it another go now, but when I try to login to the web UI, I get an error that the certificate expired.

I've check root cron and there's no job to renew the certificate, hence my questions:
1. does the 3cx debian package have feature to renew the certificate automatically on its own?
2. do I need to set up the default ACME client to renew the certificate?
3. is there maybe a custom 3cx-targeting client to renew certificate?
4. (ideally) is there a guide on how to solve this problem from CLI now? I have no experience with letsencrypt + nginx on non-default port.

Thanks!

 

[YiannisH_3CX]

Hello @stangri

Are you using a 3CX FQDN or your own? If you are using a 3CX FQDN make sure that your maintenance is still valid. You can check by navigating to settings / Licence.
Also make sure that you can correctly resolve the sites activations.3cx.com and letsencrypt.org from the 3CX server. Also is this a local installation or hosted in the cloud?

 

[stangri]

Are you using a 3CX FQDN or your own?

3cx FQDN.

If you are using a 3CX FQDN make sure that your maintenance is still valid. You can check by navigating to settings / Licence.

I can't -- no access to WebUI because of HSTS and expired certificate.

Also make sure that you can correctly resolve the sites activations.3cx.com and letsencrypt.org from the 3CX server.

I assume you meant activation and not activations:

$ nslookup activation.3cx.com
Server:        169.254.169.254
Address:    169.254.169.254#53

Non-authoritative answer:
Name:    activation.3cx.com
Address: 151.80.125.88

$ nslookup letsencrypt.org
Server:        169.254.169.254
Address:    169.254.169.254#53

Non-authoritative answer:
Name:    letsencrypt.org
Address: 23.14.161.99

Also is this a local installation or hosted in the cloud?

Cloud.

 

[YiannisH_3CX]

Can you send me your FQDN on private message so i can take a look at the issue?

 

[Sopock]

I can't -- no access to WebUI because of HSTS and expired certificate.

Also no access to customer portal?

does the 3cx debian package have feature to renew the certificate automatically on its own?

For that all services should run!
Next cert renew at

 

[stangri]

Also no access to customer portal?
For that all services should run!
Next cert renew at

I've checked the CloudServiceWatcher.log:

------------|Inf(00)|  Date: 11/1/17 1:17:25 AM
2017/11/01 01:17:25.538|0005|Info(03)| Starting pbxconfigtool to renew certs
2017/11/01 01:17:33.323|0005|Info(03)| Cleaning old global logs task has been started...
2017/11/01 01:17:33.351|0005|Info(03)| Cleaning old global logs task has been finished
2017/11/01 01:17:33.509|0005|Info(03)| Task is finished
2017/11/01 01:17:33.509|0005|Info(03)| Next cert renew at: 11/2/17 1:33:30 AM

Will send a PM momentarily.

 

[Sopock]

And now look in pbxconfigtool log?

 

[stangri]

And now look in pbxconfigtool log?

It reported that the certificate in /var/lib/3cxpbx/Bin/nginx/conf/Instance1/ is valid, so then the `a-ha` moment occurred and I just reloaded nginx and now it works!

PS. Note to devs -- make sure nginx is reloaded/restarted after certificate is updated.

 

[YiannisH_3CX]

Glad the issue is now resolved and thank you for sharing your solution