Certificate expired April 1 2023

[StuNor]

Hi, this morning, April 3, our PBX is showing an expired certificate dated April 1 2023.

I have been checking the firewall traffic and I can't find any evidence that communication to activate.3cx.com is being blocked. Traffic is flowing from the PBX to 104.18.14.54 and 104.18.15.54 and there is no blocked traffic from the PBX.

Could this issue be related to the main documented security incident?

Thank you for your advice.

Regards,
Stuart.

 

[nub]

Hi, this morning, April 3, our PBX is showing an expired certificate dated April 1 2023.

I have been checking the firewall traffic and I can't find any evidence that communication to activate.3cx.com is being blocked. Traffic is flowing from the PBX to 104.18.14.54 and 104.18.15.54 and there is no blocked traffic from the PBX.

Could this issue be related to the main documented security incident?

Thank you for your advice.

Regards,
Stuart.

What ver of 3cx?

https://3cxdomainname:5001/#/app/settings/license
is your License Expires < April or Maintenance < April?

https://3cxdomainname:5001/#/app/system_status/services
restart all the services and look at the Activity Log:
https://3cxdomainname:5001/#/app/system_status/activity_log


I get an email every 3 months that looks like this:
"HTTPS Certificate was successfully renewed"

or sometimes like this:

"The SSL Certificate for your 3CX installation at % was automatically renewed for the next 90 days.
Your 3CX web server is now secure and all web traffic that passes via 3CX is encrypted."

Search your email for "3cx certificate" and see that last one you got.

 

[JohnS_3CX]

Note: If the PBX is shut down during the evening it will not update the certificate because it happens as a scheduled task after midnight.

 

[StuNor]

Sorry, v18 build 418.

I have taken those actions and the certificate remains expired. I don't have any notification emails. I can't see any entries in the activity log to identify the problem.

I'll report back when I get a resolution.

 

[StuNor]

Thanks John, I'll check tomorrow morning.

 

[StuNor]

My apologies for the delay in reporting back.

John, you were of course correct. Overnight the certificate was updated.

Unfortunately, it seems I won't be able to diagnose why it didn't update the certificate before it expired. I'll keep close watch when the new certificate is approaching expiry.

Can I confirm? Is the host, activate.3cx.com, the only host that needs to be contacted for the purposes of certificate updates?

Regards.

 

[JohnS_3CX]

Glad to hear this helped!

Yes, we have a list here if you want to add the main ones the system needs, including activation and certs renewal:
https://www.3cx.com/docs/manual/firewall-router-configuration/#h.8pfa34ntckn1

Also make sure your system is not shut down/suspended, or disconnected from the internet after midnight via any means.

If it shuts down on a schedule or is suspended = no attempt will be made, no indication that there is an issue.

If the internet goes down at night or on a schedule = the "failure to renew" email might not be able to go out to inform you of the event, but you will see an error in the Event Log at least. If this is entry exists then it's a matter of internet connectivity most likely (or DNS perhaps).