Custom SSL Certificate Not Trusted – Certificate Chain Issue in 3CX

[Roopesh Balakrishna]

Issue details:

The server’s SSL/TLS certificate cannot be fully trusted due to problems with the certificate chain. We are currently using a custom SSL certificate issued by a third-party vendor.

When running an SSL Certificate Checker, the result indicates that the vendor-signed SSL certificate is not trusted, even though the certificate itself is valid.

Questions:

1. Does 3CX fully support third-party/custom SSL certificates?
2. Are there any specific requirements or supported vendors for custom certificates?
3. Is there a recommended way to resolve certificate chain issues in this scenario? Any guidance or confirmation from the community or 3CX team would be appreciated.

 

[bitn2]

Sure: https://www.3cx.com/docs/fqdn-ssl-certificate/

 

[Charles_3CX]

You can use custom FQDNs with your own domain and certificate; you just need to ensure that when you add the certificate PEM file, it also includes the intermediate and root certificates for the certificate authority.

 

[Roopesh Balakrishna]

You can use custom FQDNs with your own domain and certificate; you just need to ensure that when you add the certificate PEM file, it also includes the intermediate and root certificates for the certificate authority.

We are using custom certificate but during SSL certificate Checker we are seeing this error.

 

[Roopesh Balakrishna]

We are using custom certificate but during SSL certificate Checker we are seeing this error.

We are using Debian 12 as operating system

 

[Charles_3CX]

Correct, but you didn't include the intermediate or root certificate from the CA within the certificate pem file; you only included the certificate for your FQDN.

 

[Roopesh Balakrishna]

Correct, but you didn't include the intermediate or root certificate from the CA within the certificate pem file; you only included the certificate for your FQDN.

Thank you for the clarification. You’re correct — the PEM file currently includes only the FQDN certificate and is missing the intermediate and root certificates from the CA. Any idea how we can fix this? Do we need to create a new CSR?

 

[SweetAction]

Thank you for the clarification. You’re correct — the PEM file currently includes only the FQDN certificate and is missing the intermediate and root certificates from the CA. Any idea how we can fix this? Do we need to create a new CSR?

No, you simply need to edit the cert file and add them.

If you edit the PEM file notepad or nano you will see a line ---BEGIN CERT--- and another line ---END CERT---

• If only 1 section is present, you need to add the rest of the certificate chain to the file. You can use whatever tool you like. (see image below for formatting)
  • You can test with this site https://tools.keycdn.com/ssl which should show the full certificate chain
    
    
    (Make sure you have the certificate, the intermediate, the cross-signed if applicable, and the root certificate in the correct order (technically root isn't needed, but doesn't hurt to have it))

 

[Charles_3CX]

You can download the intermediate and root certificates from the CA you used to generate the certificate. Then add thewm to the Pem file in the format

-----BEGIN CERTIFICATE-----
[Your Domain/Server Certificate ]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[Intermediate CA Certificate]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[Root CA Certificate]
-----END CERTIFICATE-----

The PEM certificate files are located at/var/lib/3cxpbx/Bin/nginx/conf/Instance1 and are named YOURFQDN-crt.pem.

Be sure to do this in your SSH terminal so you don't have to change permissions when downloading and re-uploading as root, then restart the nginx service.