SSL Certificate Renewal Failed .....every night

[dsidata]

I have an On-site 3CX server for the past 5+ years. One month ago when the (every 3rd month) process for automatically renewing my SSL certificate was supposed to start, it's been failing every night.
I tried all the obvious stuff like restarting services, server, latest update etc. to no avail. It must have started after the 3CX v16 service pack right before the last, because the latest one didn't fix the problem. I haven't changed anything on the server in a long time. Here is the message I get:

The SSL Certificate renewal for <redacted>.3cx.us failed - Error:Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException: The requested operation is not supported.

at System.Security.Cryptography.CngKeyLite.SetKeyLength(SafeNCryptKeyHandle keyHandle, Int32 keySize)

at System.Security.Cryptography.CngKeyLite.GenerateNewExportableKey(String algorithm, Int32 keySize)

at System.Security.Cryptography.DSAImplementation.DSACng.GetDuplicatedKeyHandle()

at System.Security.Cryptography.DSAImplementation.DSACng.ExportKeyBlob(Boolean includePrivateParameters)

at System.Security.Cryptography.DSAImplementation.DSACng.ExportParameters(Boolean includePrivateParameters)

at PostInstall.CertificateUtils.DsaToDhParams(DSA dsa)

at PostInstall.CertificateGenerator.GenerateDhParam()

at PostInstall.CertificateGenerator.ProcessCertificatesDirectory(String directory, Boolean temporaryCertificateGenerated, Int32 regenerateNotSelfSignedCertificatesFrom, Int32 regenerateNotSelfSignedCertificatesTo, CloudServerStatus statuses, Int32 regenerateCertificateExiredInDays, String appBin, UInt16 sipPort, UInt16 tunnelPort, Nullable`1 httpPort, Nullable`1 httpsPort, Boolean isPassiveFailoverMode)

at PostInstall.CertificateGenerator.RenewCertificates(String appBin, String nginxConfigFolder, String configurationPath)

 

[cobaltit]

https://www.3cx.com/community/threads/information-to-provide-when-requesting-help.67558/

But I'm guessing you are on Windows 2012 R2 or earlier which is no longer supported.

 

[dsidata]

Is it documented somewhere that SSL renewals will not work on older OS's, or is that just a tact to avoid fixing something that an update broke once again?
I'd be glad to install a new SSL certificate myself if that's what it would take.

 

[cobaltit]

Specifically that SSL renewals won't work? No. But there's this page which lists the system requirement for windows as Windows 10, Server 2016+:

https://www.3cx.com/docs/manual/phone-system-installation-windows/

There was this blog post from January (and pretty sure emails sent out) about needed to be a supported environment because of upcoming Apple Push changes:

https://www.3cx.com/blog/releases/apple-push-update-windows/

There were also emails sent out recently about the need to upgrade to v15.5 U6a or v16 Update 6 by 9/15 due to internal 3CX certs expiring, which would also require you to be on a supported OS.

As far as why it doesn't work, who knows. Doesn't really matter if 3CX 'broke' something on an OS they don't test on because it's not supported anymore.

If you want to put your own cert on, go right ahead, that is supported with the proper license (and supported OS).

 

[jpercival]

Our on-site Windows Server 2019 VM (running 3CX Enterprise Annual 16.0.6.655) has been getting those same errors for over 2 weeks.

 

[JohnS_3CX]

Is it documented somewhere that SSL renewals will not work on older OS's, or is that just a tact to avoid fixing something that an update broke once again?
I'd be glad to install a new SSL certificate myself if that's what it would take.

Hi

I'm confirming that we found issues with older PBX systems that cannot negotiate newer SSL/TLS protocols and ciphers. If you want this to work automatically just as we designed and tested it, then you need to use a supported OS. For Windows, that has to be Windows 10, or Windows Server 2016 Datacenter and above (with the latest security updates and patches installed). Do not expect anything older than this to work, activate or renew.

In addition, if you have performed your own SSL/TLS hardening by disabling certain ciphers, you will have to manually troubleshoot this and re-enable anything you have removed that may be breaking communication with 3CX servers or Let's Encrypt (and Google/Apple if you use mobile apps).

You never told us what your current OS is however


Documentation can be found here: https://www.3cx.com/docs/manual/phone-system-installation-windows/