Issue with Inbound SMS After SSL Certificate Update for NGINX. Sectigo updated Root and Intermediate CA

[lcf-itsupport]

After replacing our SSL certificate and key pair for NGINX, inbound SMS messages are no longer being received. However, when we revert to the previous certificate, the issue resolves.

Certificate paths in use:

• C:\ProgramData\3CX\Bin\nginx\conf\Instance1\domain_cert_<fqdn>.pem
• C:\ProgramData\3CX\Bin\nginx\conf\Instance1\domain_key_<fqdn>.pem

Notably, Sectigo recently updated its public intermediate and root certificates (as of 6/2/2025): https://www.sectigo.com/faqs/detail/Sectigo-Public-Intermediates-and-Roots/kA0Uj0000003eov

Additional Observations:

Outbound SMS works as expected.

Secure SIP (inbound and outbound calls) continues to function normally using the new certificate/key pair:

• C:\ProgramData\3CX\Instance1\Bin\Cert\domain_cert_<fqdn>.pem
• C:\ProgramData\3CX\Instance1\Bin\Cert\domain_key_<fqdn>.pem

It appears that only the webhook used for inbound SMS is not accepting the new certificate, likely due to a trust issue.

We've contacted our carrier’s support team, but they believe the issue lies on the 3CX side.

Looking for insights or guidance from others who may have encountered similar issues. Could this be related to the updated Sectigo chain not being fully trusted in the webhook's validation path?

 

[Saky]

Hi,

As you say this is most likely a gap in the validation chain where the carrier is missing some newer cert.

If you hit your endpoint from a browser, does it show that your certificates are all in order?

 

[YiannisH_3CX]

For SIP TLS you also need to replace the certificates in C:\ProgramData\3CX\Instance1\Bin\Cert

Also which provider are you using for SMS?

When you are receiving an SMS your PBX is actually the server so the sender needs to trust your certificate. So most probably the provider is not trusting your certificate for some reason.

 

[lcf-itsupport]

For SIP TLS you also need to replace the certificates in C:\ProgramData\3CX\Instance1\Bin\Cert

Yes, this was done as indicated in the "Secure SIP" section in my original post.

Secure SIP (inbound and outbound calls) continues to function normally using the new certificate/key pair:

• C:\ProgramData\3CX\Instance1\Bin\Cert\domain_cert_<fqdn>.pem
• C:\ProgramData\3CX\Instance1\Bin\Cert\domain_key_<fqdn>.pem

Also which provider are you using for SMS?

Telnyx

When you are receiving an SMS your PBX is actually the server so the sender needs to trust your certificate. So most probably the provider is not trusting your certificate for some reason.

There does not appear to be any place within the messaging config for our account to add the new Root / Intermediate Certs. Only the Webhook URL from 3CX.

 

[YiannisH_3CX]

There does not appear to be any place within the messaging config for our account to add the new Root / Intermediate Certs. Only the Webhook URL from 3CX.

There is no additional settings specifically for SMS. The webhook request is Https so the Nginx certificates are in play.

What you could do is run a pcap on your machine and send an inbound SMS. Stop the pcap and check for traffic from the providers SMS API.
You should see the TLS handshake attempt and if that is failing or not.

 

[lcf-itsupport]

There is no additional settings specifically for SMS. The webhook request is Https so the Nginx certificates are in play.

What you could do is run a pcap on your machine and send an inbound SMS. Stop the pcap and check for traffic from the providers SMS API.
You should see the TLS handshake attempt and if that is failing or not.

I have performed the PCAP for both a successful inbound SMS message (Old Cert) and failed inbound SMS Message (New Cert)
The first 6 packets are the same, on packet, 5 our 3cx server sends Server Hello, Change Cipher Spec.
On the successful SMS: on packet 7, The carrier sends back Change Cipher Spec.
On the failed SMS: the carrier never sends back the Change Cipher spec, fails [FIN, ACK], then starts over for a second attempt.

I have sent this information to our carrier.