Certificate Update - OnPrem 3CX Shortcut

[Drain Bamaged]

Ref: https://www.3cx.com/community/threads/update-renew-certificate.77468/

The subject article has been my guide for the last 5 years on how to update certs on 3CX, specifically:

openssl pkcs12 -in [yourfile.pfx] -nocerts -out [keyfile-encrypted.key]
openssl rsa -in [keyfile-encrypted.key] -out [keyfile-decrypted.key]
openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [certificate.pem]

However, an incident this week forced me to re-examine this. I could not use the latest version of OpenSSL The RC2-40 algorithm is no longer supported by OpenSSL which was erroring out my conversion. I wanted to share my solution as it is a lot easier than using OpenSSL.



After receiving your new cert, import it into the Digicert Certificate Utility for Windows. This is a free tool.

Import your cert using the DCUW software. Then export it.



At the export screen, do not export the PFX. Select "key file (Apache compatible format)" option. Enter where you want to save it and the file name for the key, click Finish.





This produces three files:


Rename the .crt file to certificate-crt.pem and the .key file to certificate-key.pem (Matching your cert names as appropriate, of course)

Replace the certs on the 3CX server in this folder (Backup the old ones, just in case something does go wrong and you can recover): C:\Program Files\3CX Phone System\Bin\nginx\conf\instance1

Then restart the 3CX Phone System Nginx Webserver service and you are done. Much faster, no terminal typing, no editing of bag attributes and much less chance of error overall.

Hope this can help someone else. Cheers.

 

[SweetAction]

Hey, my post/guide!

I'm unsure what is happening on your version of OpenSSL. While my guide is cross OS compatible using open source tools, I'm glad you have a GUI method for Windows users who prefer it. I can however promise that OpenSSL can still convert certs for you.

 

[Drain Bamaged]

Good Day @SweetAction

If you look at the post, I showed the errors I was getting using the OpenSSL method. I used those three commands for many years on 6 3CX servers without issue until I hit a wall with the RC2-40 error I screenshotted. Am not sure if it is because the source wildcard cert was 'hardened' in some way deprecating the older algorithm, but I was unable to use that method to generate the certs.

Regardless, it's always good to have a plan B in your back pocket.

Cheers.