Migrating from Custom SSL Certificates to 3CX Let's Encrypt – Reprovisioning Required?

[vlt]

Hi everyone,

Has anyone had experience migrating from a custom SSL certificate to the 3CX-provided Let's Encrypt certificate?

With the upcoming changes to SSL certificate validity periods, we're looking to move away from manually renewing our wildcard certificates.

We currently manage approximately 6 3CX PBXs, all using a custom wildcard SSL certificate, and would like to transition to 3CX's built-in Let's Encrypt certificates.

A few questions:

• Is there an official guide or recommended procedure for this migration?
• Will existing IP phones and 3CX SBCs need to be reprovisioned?
• Can we migrate without having to redeploy the PBXs or reconfigure the phones?
• Has anyone encountered issues or downtime during the migration?

Our main concern is minimizing disruption, as we would prefer not to reprovision all the phones across multiple client sites.

Any advice or firsthand experience would be greatly appreciated.

Thanks in advance!

 

[Charles_3CX]

To migrate from your custom FQDN to a 3CX-provided FQDN with automatic certificate renewal, please follow these steps:

1. Create a backup: Use the command line to create a backup excluding the licence and FQDN, as described in this guide. Download the backup.
2. Shut down the existing system.
3. Release the existing FQDN: Log in to the 3CX Portal using the licence owner’s email address and release the FQDN.
4. Deploy the new system: Install 3CX using the desired 3CX-provided FQDN. Do not restore the backup during the initial deployment.
5. Restore the backup: Once installation is complete, upload and restore the backup.
6. Reinstall the SBCs: Configure them to connect using the new FQDN.
7. Reprovision the phones: Factory-reset and provision them again.
8. Restore app access: Send password-reset emails to app users so they can access the system using the new FQDN.

This migration requires redeployment and device reprovisioning, so please schedule a maintenance window to allow for the resulting downtime.

 

[Colorado VoIP]

one item to note, when you re-link your SBCs the phones behind those SBCs will come back online even though they're pointed at the wrong URL (or at least so i've seen with all the yealink phones). but you can NOT skip the step of reprovisioning all the phones, you won't be able to rename or reassign them unless they are looking at the right URL.

so from a quickness of migration, they do link up fast with the SBCs being re-linked which buys you time for an emergency phone call per say if someone can't wait, but you still have to do all of the steps.

after hours is best unless the customer is ok with down time during the day.