3CX v18U5 failed to establish a TCP connection to activate.3cx.com

[davide.bonavita]

Hi there,
after renewing our subscription I've tried to refresh the license but the server fails to communicate with the activation service.
- The server version is 18.0 Update 5 (Build 418), from what I've read in the other posts it should only fail for versions < U5
- I've tried using 8.8.8.8 as only dns server and reboot the server, no luck. This is the output of dig:

root@ip-172-26-12-148:~# dig activate.3cx.com

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> activate.3cx.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1339
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;activate.3cx.com.              IN      A

;; ANSWER SECTION:
activate.3cx.com.       300     IN      A       104.18.40.127
activate.3cx.com.       300     IN      A       172.64.147.129

;; Query time: 4 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Mon Aug 21 15:09:48 BST 2023
;; MSG SIZE  rcvd: 77

- I can ping the service, I can only curl the url with https://

root@ip-172-26-12-148:~# ping activate.3cx.com
PING activate.3cx.com (172.64.147.129): 56 data bytes
64 bytes from 172.64.147.129: icmp_seq=0 ttl=49 time=0.747 ms
64 bytes from 172.64.147.129: icmp_seq=1 ttl=49 time=0.720 ms
--- activate.3cx.com ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.720/0.734/0.747/0.000 ms


root@ip-172-26-12-148:~# curl -I https://activate.3cx.com
HTTP/2 404
date: Mon, 21 Aug 2023 14:13:28 GMT
content-type: text/html
x-powered-by: ASP.NET
cf-cache-status: DYNAMIC
set-cookie: __cf_bm=qL1W0tfJYGvByuufi8RgHYBq.54.KGOF2353E.nydu4-1692627208-0-AWzVoE7Pb+OmiP9E1vnQe4yZs7DVMy0A9JvFljRF15UQegBYn0sM39WWe2KUCbz/667Ygg7kncDW14GnUiQSBRc=; path=/; expires=Mon, 21-Aug-23 14:43:28 GMT; domain=.3cx.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 7fa37a0fc81020d5-IAD

- There are no rules that restrict the outbound traffic

 

[jaredc]

I am having the exact same issue. I just renewed our license and receive the same error that it failed to establish a connection with activate.3cx.com. We are on 18.0 update 7.

 

[navarac]

Same here... 18.0 update 7. Just renewed the license but it won't apply because it is unable to contact activate.3cx.com. I can ping that address from the server.

 

[davide.bonavita]

At least I'm in good company

 

[Charles_3CX]

Please note that there was an update on the activation servers today to update the certificate expiring this weekend. As such, any versions under update 7 (build 424 or 441) will not activate.

Please always ensure that systems are updated to the latest versions to avoid issues activating and receiving support.

 

[davide.bonavita]

After the malware incident the updates have been put on hold by our SecTeam, I cannot update the service for the time being.
Also, I was relying on the latest blog entry about the activation server here: https://www.3cx.com/blog/releases/fqdn-endpoint-change/, I can't find any news about update 7 (build 424 or 441) being the oldest version we can use

 

[SteveITS]

any versions under update 7 (build 424 or 441) will not activate.

Since 18u8 was pulled (so quick we didn't have time to update), 18.0 Update 7 (Build 312) is the latest available.

 

[pmterp]

Please note that there was an update on the activation servers today to update the certificate expiring this weekend. As such, any versions under update 7 (build 424 or 441) will not activate.

Please always ensure that systems are updated to the latest versions to avoid issues activating and receiving support.

What is the solution? Like others, we've paused updates in preparation for the release of a stable version of v18 update 8. We have many systems on v18 update 6 at this time.

 

[Alexbg89]

I'm on version 18.0.7.312 and my license expires tomorrow. What can I do ??

 

[SweetAction]

Please note that there was an update on the activation servers today to update the certificate expiring this weekend. As such, any versions under update 7 (build 424 or 441) will not activate.

Please always ensure that systems are updated to the latest versions to avoid issues activating and receiving support.

Will U7 activate or anything under u8?

Is it possible we can get advanced notice of these changes in the future? Some clients have change freezes for various reasons and in the past, 3CX has provided at least a month of notice.

 

[Alexbg89]

Should I go ahead and do this update?

 

[SteveITS]

Will U7 activate

U7 is showing the connection error since it's way under build 424. Was build 424 7A? I thought that never made it out of beta...

advanced notice

Would be nice, but it sounds more like they realized the cert expired (unclear if "this past weekend" or "this coming weekend"). Seems like U7 and maybe U6 and earlier need a hotfix! Not good practice to just disconnect every single server...

 

[SteveITS]

View attachment 36862
Should I go ahead and do this update?

3CX, need to know if this is the path forward, since it's still marked as a beta...

 

[Alexbg89]

Customer service confirmed. Still a bit weird to have to update to a beta version to be able to activate my instance...

 

[SteveITS]

Customer service confirmed. Still a bit weird to have to update to a beta version to be able to activate my instance...

Thanks, so update 8 is required then. Yes it is weird, because they normally advise installing updates via automatic update, not manual updates. Our last automatic update installed OS updates but not the beta, since it's not supposed to do that...

 

[Charles_3CX]

So to clarify, Older builds remain activated, but going to license will stop due to the certificate change.

The system will remain working, but if you want and need to activate it, you must update to the latest update 8 build 917.

 

[Alexbg89]

So to clarify, Older builds remain activated, but going to license will stop due to the certificate change.

The system will remain working, but if you want and need to activate it, you must update to the latest update 8 build 917.

So just to confirm. I need to reactivate due to license expiration. There is no release version that will allow me to do so even if my system was in auto-update. So I need to update to a beta version to be able to reactivate?

 

[Charles_3CX]

The update to U8 build 917 is required to be able to activate if below the U7 builds 424 or 441.

The 917 version is the hotfix version for the U8 final.

 

[Alexbg89]

It's like an egg and chicken situation.. thank you

 

[pmterp]

So just to confirm. I need to reactivate due to license expiration. There is no release version that will allow me to do so even if my system was in auto-update. So I need to update to a beta version to be able to reactivate?

Based on previous experience, if the license has expired, you will not be able to update to the new version. You'll need to take a backup and then reinstall 3CX and then add your license.