How to regenerate SIP/TLS certificate for 3cx domain?

[AndreC]

Hi all,

I lost my certificates that were generated at install time in the Secure SIP tab (#/app/settings/security/159/secure_sip).
How can I regenerate them?

It's a 3CX Provided FQDN and NOT a custom domain.

Is there a way to force trigger a new generation somehow?

Thanks

 

[Evolute IT]

I was afraid of this... my very last choice... Just too bad there's no way to just trigger a regenerate of the certificates..
Problem with this is that I won't be able to remotely reconnect their phones...

It should if they use SBC or FQDN. DNS has 6h TTL for Pro and Std, 5min for Ent.

Make a test, restore the instance (make a backup without FQDN to not mess with your current IP) and see if it creates a certificate.

 

[Alphabetic]

I had an issue where my certificate / keys were gone. I had to do a backup and rebuild the PBX.

 

[cobaltit]

I was afraid of this... my very last choice... Just too bad there's no way to just trigger a regenerate of the certificates..
Problem with this is that I won't be able to remotely reconnect their phones...

You shouldn't need to do anything for the phones if they are already pointing at the PBX.

 

[AndreC]

I was afraid of this... my very last choice... Just too bad there's no way to just trigger a regenerate of the certificates..
Problem with this is that I won't be able to remotely reconnect their phones...

I got it recovered!
I forgot I had made a backup.. new backup/restored old/copy certificates/restored new/paste certificates..

Now I installed the certificate on my Yealink and changed to TLS and all good!

 

[cobaltit]

Hah, that works.

 

[AndreC]

No. STUN does require port forwarding, SBC doesn't. It eliminates a lot of headaches.

Should I start a new thread for issues installing SBC on Debian 9 ?

 

[Evolute IT]

Should I start a new thread for issues installing SBC on Debian 9 ?

You will not have issues. Just reinstall Debian from scratch using the 3CX ISO.

 

[AndreC]

You will not have issues. Just reinstall Debian from scratch using the 3CX ISO.

I can't on this device as there are no sd card.. I had to upgrade in place..

Here is what I get... is there any extra packages or libs I need to install?

PRETTY_NAME="Debian GNU/Linux 9 (stretch)"
NAME="Debian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
VERSION_CODENAME=stretch
ID=debian

Setting up 3cxsbc (16.0.390) ...
3cxsbc configuration file already exists
Job for 3cxsbc.service failed. See 'systemctl status 3cxsbc.service' and 'journalctl -xn' for details.
dpkg: error processing package 3cxsbc (--configure):
subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
3cxsbc
E: Sub-process /usr/bin/dpkg returned an error code (1)

● 3cxsbc.service - 3CX Session Border Controller
Loaded: loaded (/lib/systemd/system/3cxsbc.service; enabled)
Active: activating (auto-restart) (Result: exit-code) since Thu 2020-02-13 13:18:31 UTC; 6s ago
Process: 8673 ExecStart=/usr/sbin/3cxsbc -m /etc/3cxsbc.conf (code=exited, status=1/FAILURE)
Main PID: 8673 (code=exited, status=1/FAILURE)

 

[JohnS_3CX]

Hi @AndreC

If you look at your machine's folder /var/lib/3cxpbx/Instance1/Bin/Cert you should find your certificates

1. domain_key_yourfqdn.pem
2. domain_cert_yourfqdn.pem

These should match the management console respectively as:

1. Certificate
2. Private Key

If those files are there, you can paste their contents respectively

 

[AndreC]

Hi @AndreC

If you look at your machine's folder /var/lib/3cxpbx/Instance1/Bin/Cert you should find your certificates

1. domain_key_yourfqdn.pem
2. domain_cert_yourfqdn.pem

These should match the management console respectively as:

1. Certificate
2. Private Key

If those files are there, you can paste their contents respectively

@JohnS_3CX Where were you all this time? Thanks man ! Now I know for next time!!!

 

[AndreC]

I can't on this device as there are no sd card.. I had to upgrade in place..

Here is what I get... is there any extra packages or libs I need to install?

PRETTY_NAME="Debian GNU/Linux 9 (stretch)"
NAME="Debian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
VERSION_CODENAME=stretch
ID=debian

Setting up 3cxsbc (16.0.390) ...
3cxsbc configuration file already exists
Job for 3cxsbc.service failed. See 'systemctl status 3cxsbc.service' and 'journalctl -xn' for details.
dpkg: error processing package 3cxsbc (--configure):
subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
3cxsbc
E: Sub-process /usr/bin/dpkg returned an error code (1)

● 3cxsbc.service - 3CX Session Border Controller
Loaded: loaded (/lib/systemd/system/3cxsbc.service; enabled)
Active: activating (auto-restart) (Result: exit-code) since Thu 2020-02-13 13:18:31 UTC; 6s ago
Process: 8673 ExecStart=/usr/sbin/3cxsbc -m /etc/3cxsbc.conf (code=exited, status=1/FAILURE)
Main PID: 8673 (code=exited, status=1/FAILURE)

Seemed that I had missed some libstdc++6 libraries.. it now launches but still have some configuration issues that I need to address.

 

[JohnS_3CX]

Sorry, didn't get to you in time!

 

[AndreC]

Sorry, didn't get to you in time!

Thanks,

Everyone here have been very cooperative and I did still learn a lot, thank you all guys!

now up to fixing my s3xpbc configuration ... "Bridge failure 'Connection refused'...

 

[JohnS_3CX]

The SBC will not install on Jessie, can you upgrade the machine to stretch?

Is it x86 based? You can use the below command which will also invoke the SBC Wizard and install any necessary dependencies

wget https://downloads-global.3cx.com/downloads/sbc/3cxsbc.zip -O- | sudo bash

 

[JohnS_3CX]

You can use "purge" on "3cxsbc" to clear up everything before you start. Seems the installation already found a config file from our SBC

 

[AndreC]

You can use "purge" on "3cxsbc" to clear up everything before you start. Seems the installation already found a config file from our SBC

I now have the SBC up and running and showing in my console as a new trunk.

How can I test it? Can I add a third account on my Yealink T23G phone that would leverage the new SBC without having to reset the phone and loose all exiting config?

 

[JohnS_3CX]

Delete the phone from the extension.

Reset the device and wait for it to appear in the "Phones" section

Select it and assign it to your extension.

It should automatically populate the SBC fields in the provisioning tab of the extension

Press ok and wait for the phone to reprovision.

Ensure the phone can access the PBX via FQDN:5001 (or whatever your HTTPS port is if customized during installation)

 

[AndreC]

I just tried a factory reset of the phone and connect to the same lan as my SBC and the phone does not get detected.. it's a Yealink T23G with latest firmware..

How can I get the phone to show up in Phones?

basically;
local SBC on 192.168.10.22
phone new ip: 192.168.10.222

3CX is running on AWS and launched via the provided LightSail deployment script.
SBC is showing as active on the SIP Trunk list.

Cold it be some default ports on the Yealink that differ from what SBC expect ?

 

[AndreC]

Ok, after playing with SBC for the past 3 hours.. I reverted back to remote stun..
The reason is speed... calls to my ip phone on Direct SIP (STUN - remote) is so much faster to ring and seem to have less latency..
I guess this could be due to the small device I used to install the 3CX SBC, a C.H.I.P. which is very similar to a RaspberryPi 3. (ARMv7 Processor rev 2 (v7l) and 512MB RAM)

I will try again later with a faster device to see..

 

[JohnS_3CX]

Hi Andre,

We support 3B+ only, so performance and compatibility cannot be guaranteed nor is tested by our R&D on other devices such as the CHIP .

The not getting detected part comes down to multicast. The SBC machine must be listening to the multicast IP and the phone must be on a network that can pass the multicast messages otherwise it will never be detected. So get a 3B+ and use our Raspberry image and guide or run it on a small pc instead if you want it to perform as intended
https://www.3cx.com/docs/installing-pbx-raspberry-pi/

PS: You must be running the 3CX firmware for the T23G https://www.3cx.com/sip-phones/yealink-t20p-t22p-t26p-t28p/