Solved CERTIFICATE EXPIRY

[Chris-Maundu]

Hello 3CX Community,

I am experiencing an issue with renewing the default SSL certificate on my 3CX version 20 PBX. The certificate has expired, and despite restarting both the 3CX services and the server, the certificate has not renewed automatically.

Here are the steps I have taken so far:

1. Accessed the 3CX Management Console.
2. Restarted the "3CX PhoneSystem 01" service from the "Dashboard" > "Services".
3. Restarted the entire server.

Despite these efforts, the SSL certificate remains expired. I am unable to locate the specific section for certificate management in version 20.

Could anyone provide guidance on how to manually renew the SSL certificate or point me to the correct settings in version 20? Any help would be greatly appreciated.

 

[bitn2]

under Settings -> Parameters

TEMPORARY_SELF_SIGNED_CERTIFICATE_GENERATED set the value to 1

If Windows:

Use CMD (administrator)

Run the following command:

"C:\Program Files\3CX Phone System\Bin\PbxConfigTool.exe" -renew-certificates

If Linux:

Login SSH as root

- su phonesystem
- sr/lib/3cxpbx/PbxConfigTool -renew-certificates

Wait about 5 minutes.

You may need to restart nginx.

service nginx restart

 

[Chris-Maundu]

I am running Linux.
I have tried the above yet the certificate remains expired.

 

[NicholasP_3CX]

Do you have any network restrictions on that network that would be preventing the communication with the 3CX Activation server and the Let's Encrypt network?

 

[Chris-Maundu]

Do you have any network restrictions on that network that would be preventing the communication with the 3CX Activation server and the Let's Encrypt network?

No,
I have been running 3CX for 5 years now. The PBX has unrestricted access to the internet.

 

[NicholasP_3CX]

The procedure above is what is required if the PBX doesnt automatically renew this.

We start the renewal process 1 month before the expiry of the certificate. Your certificate expired almost 2 weeks ago.

You might need to open a ticket to support if the procedure above doesnt work, but please try it again, and follow it to the letter before doing so.

 

[Stefano_Finetti_78]

Hi, Did you manage to solve this? I'm experiencing it right now, I have the
TEMPORARY_SELF_SIGNED_CERTIFICATE_GENERATED set to 1,
launched the command as phonesystem user, but still no joy.

The machine was not shut down, it was working regularly but today we can't access the web interface because the certificate expired on May 6th and did not renew.

I've also restarted nginx and waited, without success.

 

[Stefano_Finetti_78]

I had to manually copy the new letsencrypt certificate into /var/lib/3cxpbx/Bin/nginx/conf/Instance1 and then restart nginx

 

[NicholasP_3CX]

I had to manually copy the new letsencrypt certificate into /var/lib/3cxpbx/Bin/nginx/conf/Instance1 and then restart nginx

Your own FQDN and SSL certificate will not auto-renew. That is only for 3CX FQDNs and SSL certificates.

You did exactly what you hadd to. Its your own certificate so you are responsible for its renewal.

 

[Stefano_Finetti_78]

Your own FQDN and SSL certificate will not auto-renew. That is only for 3CX FQDNs and SSL certificates.

You did exactly what you hadd to. Its your own certificate so you are responsible for its renewal.

Yeah I figured that when I understood that my certificates where in fact renewed but not seen by 3CX.
It's a bit undocumented though.
I made a bash script running in a cron schedule that will take care of this before the expiration date of the certificate.

 

[NicholasP_3CX]

https://www.3cx.com/docs/fqdn-ssl-certificate/

There is a note at the bottom to have the SSL certificates imported into the OS (file system)

 

[Stefano_Finetti_78]

Let's say that the last sentence is not particularly clear if you're looking for an explanation

Anyway my bash script, after certbot renewed the certificates, will backup the existing and copy the new ones inside 3CX directory, It should solve any potential issues that could arise in future.

Thanks for the link though.