gogetssl.com wildcard certificates are not working

[WifxMain]

Hello,

We use the GoGetSSL Wildcard SSL certificate in the company, but it is not working with the Windows application.


[23.09.2021 14:15:02.758][38] 14:15:02.758 tlsc0C3B79CC TLS connect() error: SSL certificate verification error (PJSIP_TLS_ECERTVERIF)

[23.09.2021 14:15:02.758][38] 14:15:02.758    tsx0920BD24  Failed to send Request msg REGISTER/cseq=34894 (tdta0C2FB790)! err=171173 (SSL certificate verification error (PJSIP_TLS_ECERTVERIF))
[23.09.2021 14:15:02.758][38] 14:15:02.758    pjsua_acc.c  ..SIP registration failed, status=503 (SSL certificate verification error (PJSIP_TLS_ECERTVERIF))

If I use a softphone like MicroSIP, TLS and SRTP work fine, so this is NOT a server issue.

Any workaround ?

 

[NickD_3CX]

Have you installed the 3CX Server with a Wildcard Certificate and a Custom FQDN (not a 3CX one)?

If so, yes, the webserver should be fine with the wildcard certificate, but for SIP TLS wildcard certs are not supported.
I am not sure why other clients work (maybe they ignore the chain?), but if you want to use SIP TLS properly, you must not use a wildcard certificate.

 

[WifxMain]

Have you installed the 3CX Server with a Wildcard Certificate and a Custom FQDN (not a 3CX one)?

If so, yes, the webserver should be fine with the wildcard certificate, but for SIP TLS wildcard certs are not supported.
I am not sure why other clients work (maybe they ignore the chain?), but if you want to use SIP TLS properly, you must not use a wildcard certificate.

Thank you for the reply, yes Wildcard work fine for the webserver.
This is sad ... Because we pay a lot for the wildcard certificate.
We host about 50 3CX servers for our clients and my boss wont be very happy with extra costs.

Is there a way to have cheap or free certificates (recognized not self-signed) to use with SIP TSL ?

 

[NickD_3CX]

Thank you for the reply, yes Wildcard work fine for the webserver.
This is sad ... Because we pay a lot for the wildcard certificate.
We host about 50 3CX servers for our clients and my boss wont be very happy with extra costs.

Is there a way to have cheap or free certificates (recognized not self-signed) to use with SIP TSL ?

Yes! Use the FQDNs 3CX provides which are from Let's Encrypt!

• It will probably make your installations faster
• You won't need to worry about certificate renewals, they will happen automatically, as long as the key has valid subscription/maintenance
• The certs issued for each installation are not wildcard, so they can be used for SIP TLS
• This is done at no extra cost, it is included in maintenance/subscription fee of license