Certificate renewal failed.

[PAVNL]

In the last days, I received several messages stating
The SSL Certificate renewal for [FQDN] failed - Network problem SSL certificate failed due to network conditions. Unable to reach Certificate Issuing Servers. We will try again in a couple of hours.

Looking at the logs, the following lines point to the cause of the error:

2025/09/01 03:46:02.220|0001|Info| [PostInstall.CertificateGenerator] Sending request to ERP to create FQDN and certificates
2025/09/01 03:46:02.252|0001|Debg| [PostInstall.ErpService] TryGetLocalIpListOsDependent
2025/09/01 03:46:02.299|0001|Debg| [PostInstall.ErpService] TryGetLocalIpListOsDependent. Result = [{"Description":"ens3 (ens3)","HasDefaultGateway":true,"IsIpv6":false,"IpAddressStr":"192.168.10.68"}]
2025/09/01 03:46:02.409|0001|Info| [_3CX.HttpClient] Sending 'POST/2.0' to 'https://activate.3cx.com/apiv2/FQDN'
2025/09/01 03:47:42.418|0009|Erro| [_3CX.HttpClient] Request towards 'https://activate.3cx.com/apiv2/FQDN' failed after 100004.0ms
A task was canceled.
2025/09/01 03:47:42.426|0009|Info| [PostInstall.ErpService] Task was cancelled.
The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing.
2025/09/01 03:47:42.489|0009|Info| [PostInstall.ErpService] Error calling ERP
IpUpdater.FqdnGenerationException: The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing.
---> System.Threading.Tasks.TaskCanceledException: The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing.
---> System.TimeoutException: A task was canceled.
---> System.Threading.Tasks.TaskCanceledException: A task was canceled.
at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellationAsync(CancellationToken cancellationToken)
at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
at Microsoft.Extensions.Http.Logging.HttpClientLoggerHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
at Microsoft.Extensions.Http.Logging.HttpClientLoggerHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
--- End of inner exception stack trace ---
--- End of inner exception stack trace ---
at System.Net.Http.HttpClient.HandleFailure(Exception e, Boolean telemetryStarted, HttpResponseMessage response, CancellationTokenSource cts, CancellationToken cancellationToken, CancellationTokenSource pendingRequestsCts)
at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
at IpUpdater.ErpService.PostCreateFqdnRequest(String requestBody, Boolean passiveFailoverMode)
--- End of inner exception stack trace ---
at IpUpdater.ErpService.PostCreateFqdnRequest(String requestBody, Boolean passiveFailoverMode)
at IpUpdater.ErpService.PostCreateFqdnRequest(String externalFqdn, String fqdnDomainCode, String publicIp, String licenseKey, Byte[] certificateSignedRequest, String customFqdn, Boolean skipPorts, Boolean passiveFailoverMode, Boolean enableDnsHelper, Action`2 errorCallback, Action retryCallback)
2025/09/01 03:47:42.580|0009|Info| [PostInstall.CertificateGenerator] Error sending request to ERP: The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing.. Try again after 00:00:30

However, logging in SSH shows no issues in locating the URL

root@debian:/usr/lib/3cxpbx# nslookup activate.3cx.com
Server: 8.8.8.8
Address: 8.8.8.8#53

Non-authoritative answer:
Name: activate.3cx.com
Address: 104.18.35.19
Name: activate.3cx.com
Address: 172.64.152.237
Name: activate.3cx.com
Address: 2606:4700:4400::ac40:98ed
Name: activate.3cx.com
Address: 2606:4700:4400::6812:2313

My firewall turns out to be OK (al tests passed). There were no changes to the config.

I'm stuck. I already restarted the VM, but that does not seem to help. Does anyone have another idea where to look?

Art.

 

[KyriacosS_3CX]

Hello,

Certificate renewal is started generally ahead of time and is retried if it fails. This might have been a temporary network issue.

Sometimes disabling IPv6 helps. Check if by tomorrow it's not updated there is info in the forum on how to force that.

 

[jlmoreno_Xmartek]

Hello,

We've had some PBX systems experience the same issue, but the certificate was renewed automatically the next day.

However, if you prefer not to wait, reinstalling the system typically triggers the certificate renewal immediately (assuming there are no network-related errors).

 

[bitn2]

However, if you prefer not to wait, reinstalling the system typically triggers the certificate renewal immediately (assuming there are no network-related errors).

That is absolutely not necessary... You can do this easy by cli

 

[KyriacosS_3CX]

@PAVNL as mentioned above, do not go for a reinstall, there are far easier ways with much less "risk".

 

[KyriacosS_3CX]

For reference:

Solved Post in thread 'CERTIFICATE EXPIRY'

Feb 27, 2025

under Settings -> Parameters

TEMPORARY_SELF_SIGNED_CERTIFICATE_GENERATED set the value to 1

If Windows:

Use CMD (administrator)

Run the following command:

"C:\Program Files\3CX Phone System\Bin\PbxConfigTool.exe" -renew-certificates

If Linux:

Login SSH as root

- su phonesystem
- sr/lib/3cxpbx/PbxConfigTool -renew-certificates

Wait about 5 minutes.

You may need to restart nginx.

service nginx restart

• bitn2

• 

 

[jlmoreno_Xmartek]

@bitn2, Thank you, I didn’t know about this way.

 

[KyriacosS_3CX]

@PAVNL , did you manage to update?

 

[PAVNL]

No. Yesterday I did a full server restart (3CX is in a VM) due to an update. All functions run as normal. The certificate still does not update, not automatically neither the manual push as referred to in this post. I'm afraid that a full reinstall will be neccesary.

 

[KyriacosS_3CX]

Hi,

As you are in a VM that does make it easier as you can keep the old machine on standby in case the re-install for whatever reason leaves a problem.

You are still getting the same error? If you try to telnet to that host, you can connect OK? If not, send me your IP via Direct Message, just to check if there is any blacklist on it - but with a green firewall check I don't expect that.

 

[PAVNL]

Well, I discovered the issue. Since the firewall status was green, I did not investigate the router, as there had been no change in forwarding ports (I had already checked). However, as a security measure, non-specified ports 1-2527 and 2529-4999 were blocked. This was a setting inserted from the start in 2017. Either the settings were still there but disabled, and someone enabled these again, or 3CX is now using one or more ports in these ranges, which are not validated by the firewall check in 3CX. Anyway, for now, I disabled this service blocking, and everything works again.

Thx for all your help!