Solved [SOLVED] 3CX Phone System - HTTPS Certificate renewal Failed

[tech27]

Receiving this error on a daily basis on one of our client's Azure cloud hosted instances with a 3CX provided FQDN. Attempted to open a support ticket, but was asked to pay a fee to get support, even though we have never let maintenance lapse. Reaching out to the community to see if anyone here has any ideas.

HTTPS Certificate renewal Failed - Max certificate limit The maximum number of certificate requests has been exceeded. The limit is 5 certificates for the same domain per week. SSL certificate is no longer valid or will expire. This is a sign of multiple installations using the same FQDN being active other than this one.

Firewall test passes.
DNS resolves activation.3cx.com and letsencrypt.org.
License is valid and has maintenance.
No updates available in the UI.
There are no other instances using this FQDN, as the end of the error states.
3CX is otherwise working fine and no reported issues from the customer.

Thank you.

 

[cobaltit]

Well that's not a 3CX error that's a LE error. As far as support your site says you are a 3CX partner so you shouldn't be charged for support.

 

[tech27]

Well that's not a 3CX error that's a LE error. As far as support your site says you are a 3CX partner so you shouldn't be charged for support.

Agreed, but since LE is built-in to 3CX v15.5, I'm not sure where to start with diagnosing it. I checked crontab and browsed through some directories trying to find some indication of where it's installed, but didn't find anything useful.

I reached out to my account manager as well.

 

[cobaltit]

If you really want to dig through logs generate a support package and look in there. I haven't had to diagnose a LE issue but that's where I'd start. Hopefully your account manager gets back to you before things go boom.

 

[YiannisH_3CX]

Hello @tech27

Your error suggests that there were too many installation attempts with the same FQDN or the FQDN is used in more that one location and Let's Encrypt cannot issue any more certificates for this FQDN.

 

[tech27]

Hello @tech27

Your error suggests that there were too many installation attempts with the same FQDN or the FQDN is used in more that one location and Let's Encrypt cannot issue any more certificates for this FQDN.

Any idea how to fix it?

 

[YiannisH_3CX]

That would depend on what the issue actually is. Are there multiple installations with the same FQDN or were there too many attempts to install a PBX with the particular FQDN? It could also be the renewal request was sent too many times due to a firewall issue.
One solution i can think of is re-installing using a different FQDN. You will need to release the licence from the FQDN first.

 

[tech27]

There are no other instances using this FQDN.
There was only one attempt to install (moved from v14 to v15.5) and that was many months ago and it was successful. The PBX is working fine and no reported issues from the customer.
I would prefer trying to fix the issue rather than re-installing, which would require manual reprovisioning of their phones, updating users with the new URL, etc. I checked crontab and browsed through some directories trying to find some indication of where LetsEncrypt is installed, but didn't find anything useful.

 

[cobaltit]

@tech27

The only fix is to wait, assuming the issue is some sort of transient issue that is no longer there. LE has rate limits that you've hit for some reason and it will reset. Any chance that old box is still kicking around somewhere?

https://letsencrypt.org/docs/rate-limits/

 

[tech27]

No, the old multi-tenant box that was on v14 is long gone. Even still, the 3CX FQDN is a new feature that we didn't have on the old version.

I have been waiting; it started on Sunday:

HTTPS Certificate renewal Failed - Error:

IpUpdater.FqdnGenerationException: ERP return error status InternalServerError

at PostInstall.CertificateHelper.ProcessCertificatesDirectory(String directory, Boolean temporaryCertificateGenerated, CloudServerStatus statuses, Int32 regenerateCertificateExiredInDays, String appBin, UInt16 sipPort, UInt16 tunnelPort)

at PostInstall.CertificateHelper.RenewCertificates(String appBin, String nginxConfigFolder, String configurationPath)

(the first error was a bit different, the daily errors since Monday have been the same message in my initial post on this thread).

Any other ideas? I'm weary of blindly going in and starting to mess with things, in case it further breaks the system. Right now the server is operating fine with the exception of these daily emails about the certificate renewal failing.

 

[YiannisH_3CX]

Please check your inbox as i will need some additional info in order to look further into your issue.

 

[tech27]

Please check your inbox as i will need some additional info in order to look further into your issue.

Sorry for my late response. The issue resolved itself. It took about a week of getting the daily failure emails mentioned in my initial post, but it somehow worked itself out after about a week.

 

[YiannisH_3CX]

Glad to see that issue has been resolved. These issues are likely to "auto" resolve as the PBX will try to update the certificate at set time intervals. If in the meantime the restriction was lifted by Let's Encrypt then the certificate will successfully renew.