Cannot logon to PBX Express due to invalid Certificate

[Michael Star]

Hi,

I used the PBX Express previously to set up an installation and it used to work fine until now. My installation was accessible through: http://securepbx.3cx.asia but Suddenly I am unable to logon to the installation and the Certificate is invalid because Certificate name is not the same as the installation name (Certificate is for xuwang.3cx.ae and 3cx sets the Certificate automatically so I didn't change anything myself).

I can force to go to the unsafe login page through an incognito tab, but then it says my credentials are invalid, even though I have not changed my login details. I also tried to reset the credentials but don't receive any email to reset anything.

I am basically completely unable to get to the management console and have no way to reset my access to it. Something is very wrong with this 3cx express and I'm not impressed on how a security certificate of another domain could be set on my domain.


Please advise on how to proceed.

 

[nub]

when was the last time you made a call using the pbx?

 

[Michael Star]

Can't be 100% sure without being able to check the log but probably within the last month or so. I do register my 3cx client to it every day, which is how I found out something was wrong as it suddenly failed to register yesterday. So not only can I not log on to the management console anymore, my phone also can't register out of the blue. I log on to the management console at least once a month to check a few things and practice config settings for another server.

What I would really like to know is how on earth my installation ended up with the SSL Certificate from https://xuwang.3cx.ae ?! The server automatically renews the Certificate and I did not receive a notification about a new certificate being installed 2 days ago.

 

[nub]

I do not know if your install falls under this:
The one year free offer requires that you use the PBX. If less than 5 calls are made per month on the PBX.

To me it sounds like your ip was reissued to another pbx which would cause the cert error.]]

Note: I could be very wrong on this.

 

[Michael Star]

According to the license key details all should still be ok, but you could have a point, although It would be very unprofessional if I hadn't received any kind of warning about service cancellation.

This document certifies that the undersigned is the registered owner of the product:
License Key XXXX-XXXX-XXXX-XXXX (manually cleared this for this post)
Product 3CX Phone System Standard - Annual
Product Code 3CXPSSPLA12M16
Expiry Date Expires on 29 September 2019
Maintenance Expires on 29 September 2019
Date of Issue 26 June 2017

Subscription Expiry: 29 Sep 2019
FQDN: securepbx.3cx.asia
FQDN IP: 35.240.185.61

Note: Certificates aren't issued to IP-addresses
Note 2: The .asia extension isn't even the same TLD as .ae

 

[JohnS_3CX]

Hi Michael,

Did you create this as a free instance initially? The free instances are not renewable and meant for evaluation and then you need to migrate it to your own host.

We send out notifications about the instance deletion 10 days prior to this at the email address you signed up with so you can have a chance to migrate your installation to your own host of choice (i.e AWS, Azure, Google Cloud) or on-premises.

Your key expiry is separate from the the free hosting instance, and the key will continue to be valid after the instance is deleted.

 

[Michael Star]

Hi Michael,

Did you create this as a free instance initially? The free instances are not renewable and meant for evaluation and then you need to migrate it to your own host.

We send out notifications about the instance deletion 10 days prior to this at the email address you signed up with so you can have a chance to migrate your installation to your own host of choice (i.e AWS, Azure, Google Cloud) or on-premises.

Your key expiry is separate from the the free hosting instance, and the key will continue to be valid after the instance is deleted.

Hi John,

Yes, it is a free instance I set up on the same date as I created the 3cx license and I used the PBX express for that. The instance (and my 3cx environment) are still there if you follow the link, but somehow a security certificate of another instance was installed on my server. On the very same date the wrong Certificate was installed, coincidentally, my credentials have also become invalid and I cannot reset them either. Now please consider the following: If the instance was deleted, then there wouldn't be a login screen for my environment on the FQDN: http://securepbx.3cx.asia , right?

But:

1. You can get to the login screen of my instance if you use an incognito window: http://securepbx.3cx.asia and click advanced and ignore the warning. (proceed: unsafe)
2. You can check that the installed Certificate is for https://xuwang.3cx.ae if you check the "Not secure" warning in the browser's URL and click on Certificate (invalid)

I did not receive any email about the instance being deleted and the certificate was renewed correctly about 2 months ago automatically already, of which I did receive an email notification because the services stop when that happens.

I think the fault is in a script at 3CX's end and someone should check how it's possible that an SSL Certificate of another instance got installed on my instance. This should not happen and is a major flaw/bug if it is possible. Now, I'd be more than happy to report a bug if you could tell me where I can do that or I would appreciate it if you'd escalate this thread to a department that understands my point. I'm no 3CX expert at all but when it comes to servers and certificates I'm not a noob and I know I'm correct about this certificate issue - There is something wrong with the automated certificate distribution and is most likely caused by a bug or a flaw in a script.

 

[JohnS_3CX]

Hi Michael,

There's no issues with the certificate, I can confirm the instance was indeed deleted based on your FQDN. Your FQDN now points to an invalid IP address, that was later assigned to a different instance (which explains why you see a login screen and why the certificates don't match since they belong to another instance now).

The notification email for instance deletion is sent out automatically and I can confirm that the mailing system is working (received one recently myself) but I don't know if your specific notification reached you.

As soon as you set up your system on your own hosting platform / machine your FQDN will update accordingly and start pointing at your own IP address.