For your future reference and public record, here is a copy and paste of the instructions:
Question:
How can I replace the SSL certificates for a custom domain after renewing them with my SSL authority?
Answer:
Your SSL authority needs to provide you with a public certificate and private key in PEM format.
We CANNOT assist on which authority to pick and how to obtain the certificates nor how to convert them to the correct file format, this is something outside of our scope.
Once you have the new certificates handy, you can then replace the old certificates as follow:
* For Linux:
1/ Connect with a file transfer client such as FileZilla using SSH root credentials to the phone system host.
2/ Go to folder /var/lib/3cxpbx/Bin/nginx/conf/Instance1
3/ rename the existing certificate and key as follow to keep a copy just in case:
- YOURFQDN-crt.pem => YOURFQDN-crt.pem.OLD
- YOURFQDN-key.pem => YOURFQDN-key.pem.OLD
4/ upload the new ones and name them with the same original file names as the old ones.
5/ Connect with an SSH client such as PuTTY using SSH root credentials to the phone system host.
6/ Run commands:
cd /var/lib/3cxpbx/Bin/nginx/conf/Instance1
chown phonesystem:phonesystem YOURFQDN-crt.pem
chown phonesystem:phonesystem YOURFQDN-key.pem
service nginx restart
* For Windows:
1/ Connect on the machine and run Windows Explorer.
2/ Go to folder C:\Program Files\3CX Phone System\Bin\nginx\conf\instance1
3/ rename the existing certificate and key as follow to keep a copy just in case:
- YOURFQDN-crt.pem => YOURFQDN-crt.pem.OLD
- YOURFQDN-key.pem => YOURFQDN-key.pem.OLD
4/ copy-paste the new ones in this folder and name them with the same original file names as the old ones.
5/ Go in Control Panel / Services / and restart service "3CX Phone System Nginx Webserver".
----
Your web server has now been restarted with new certificate/key pair so you should already see the new expiry dates when browsing to your management console by clicking the Lock icon and checking the certificate properties.
Follow these last steps only if using SIP TLS:
- Login as admin in your management console
- go in Settings / Security / Secure SIP
- Paste the contents of the public certificate in field Certificate, replacing previous.
- Paste the contents of the private key in the field Private Key, replacing previous.
- press OK, restart SIP service when prompted.
Let me know if you need any other KB articles.
