how to update an SSL Certificate when the CA Authority changes

[jabbott@EA]

I need to update my SSL Certificate, but the Authority has changed. How do you update the certificate when the CA has changed?

https://www.3cx.com/community/threads/update-renew-certificate.77468/#post-353919>
cd /var/lib/3cxpbx/Bin/nginx/conf/Instance1
chown phonesystemhonesystem YOURFQDN-crt.pem
chown phonesystemhonesystem YOURFQDN-key.pem
service nginx restart

CA changed from godaddy secure certificate authority - g2 to godaddy tls intermediate ca dv - r1v1

I have done this multiple times but I have not run into an issue. i believe the reason I am having an issue is that GoDaddy names. I have updated the SSL certifcates on ubuntu boxes and there is a place to update the CA certificate. Let me know if I need to do anything when the CA authority has changed.

 

[Charles_3CX]

Hi there, it’s the same process. All you need to do is ensure that your certificate that you’re uploading has the full certificate chain that includes the intermediate and root certificates from the CA along with the private key file.

 

[jabbott@EA]

Thanks I will try that and let you know.

 

[jabbott@EA]

So I tried again. And it works on Edge and Firefox. I get an Error on Chrome. I have attached pictures of the certificate on the three browsers. Below are the commands I run to create the Certificate
.
openssl pkcs12 -in 3cx_2025.pfx -nocerts -out 3cx_2025.key
openssl rsa -in 3cx_2025.key -out 3cx_2025-decrypted.key
openssl pkcs12 -in 3cx_2025.pfx -nokeys -out 3cx_2025.pem -chain


Rename 3cx_2025-decrypted.key to domain_key_3cx.eacg.com.pem
Rename 3cx_2025.pem to domain_cert_3cx.eacg.com.pem

cp domain_cert_3cx.eacg.com.pem /var/lib/3cxpbx/Bin/nginx/conf/Instance1
cp domain_key_3cx.eacg.com.pem /var/lib/3cxpbx/Bin/nginx/conf/Instance1


Please let me know what I am doing wrong.

 

[Charles_3CX]

Are you trying to create the cert directly on the 3CX system machine? As this isn't something we can suggest, advise on, or support, the certs need to be generated through the CA, and you also need to keep the private key used to generate the new cert.

 

[jabbott@EA]

No I generated the CA certificate on a Windows machine when I initially set up the on-premises 3CX server. Why does it work in two browsers but not in Google Chrome? It seems I am getting part way there.