Certify the Web auto SSL renewal

[schmork]

I am currently using a public SSL certificate from certifytheweb.com to secure my 3cx webserver and I thought I would share with everyone my auto renewal script on Windows. For those unaware, Certify the Web offers free SSL certificates that automatically renew every 90 days. You can install the software on Windows server and have it automatically bind to an IIS site. I wrote a simple Powershell script to integrate CTW with the nginx webserver used with V15.

** IMPORTANT ** Since there are possible variations to a 3CX install, make sure you back up your .pem files in nginx conf before you begin. (Default location is C:\Program Files\3CX Phone System\Bin\nginx\conf\instance1) If the process fails, just copy these files back to that folder and restart nginx.

Also this process is for public SSL certificates (e.g. phone.domain.com) and not for internal certificates

1. Install OpenSSL for Windows http://downloads.sourceforge.net/gnuwin32/openssl-0.9.8h-1-setup.exe

2. Install Certify the Web https://certifytheweb.com/home/download

3. Create a powershell file somewhere on your server (I put mine in c:\ctw.ps1)

4. This is the powershell script. Make sure to change the 3 variables at the top to your system's values.

param($result)

# Set the path to your openssl executable
set-Variable -Name ossl -value "C:\Program Files (x86)\GnuWin32\bin\openssl.exe"

# Set the path to your 3CX SSL Certificate location
set-Variable -name instance -value "C:\Program Files\3CX Phone System\Bin\nginx\conf\instance1"

# Set the hostname of your SSL certificate, you can look in the previous variable location for the current hostname
set-Variable -Name certname -value 3cx.domain.com

#Do not change this variable
set-Variable -Name certfile -value $result.ManagedItem.CertificatePath

&$ossl pkcs12 -in $certfile  -nocerts -out c:\key.txt -passin pass: -passout pass:1111
&$ossl rsa -in c:\key.txt -out $instance\$certname-key.pem -passin pass:1111
&$ossl pkcs12 -in $certfile  -clcerts -nokeys -out $instance\$certname-crt.pem -passin pass:
del /f c:\key.txt
Restart-Service -Name nginx

5. Create a new certificate for your phone server. There is plenty of documentation on https://certifytheweb.com that will show you how to set up the certificate.

6. Under the scripting tab of your new certificate, Add your ctw.ps1 script in the Post-Request PS Script section.

7. Save your certificate and then click Request Certificate.

8. OpenSSL will automatically pull the new certificate, convert it into the key and certificate files, copy the files to the nginx configuration and restart the web server.

9. You can set your Auto Renewal Interval on the Settings tab. By default it will Auto Renew every 30 days. Please note that when an Auto Renew is processed, it will restart your nginx server which may cause brief interruptions to your web clients, windows phone interface and anything else that uses http/https to communicate with the 3CX server.

 

[CptLuxx]

Why exactly are you doing this? " certifytheweb.com" is just a tool that also uses lets encrypt to generate a certificate. And lets encrypt is already supported by 3cx and works out of the box.

 

[schmork]

Unless I am missing something, I did not see a native lets encrypt option for Windows/3CX with a user provided FQDN in all of the searches I have done. This method allows me to use my own FQDN and not a 3CX provided FQDN.