Solved SSL certificate renewal

[itops-care-bears]

hi team, ive been getting these messages for a while.

The SSL Certificate renewal for syd-xxxxxxxx.3cx.com.au failed - Network problem SSL certificate failed due to network conditions. Unable to reach Certificate Issuing Servers. We will try again in a couple of hours.

Ive not been able to understand what this SSL certificate is used for in our on-prem setup. We do not allow phones to connect/register from internet, and we also do not require access to the 3cx management page from Internet. they are only allowed and required from LAN.

do I really need a valid SSL cert?

also today i got this alert:
"Your Subscription with FQDN syd-xxxxxxx.3cx.com.au appears to be offline for an extended period of time.
We would like to inform you that if your 3CX System with the above subscription remains offline for another 10 days, the associated FQDN will be released from this subscription. This might have an effect on older backups you have of the system with this Subscription/FQDN pairing as they will no longer be usable.
In order to avoid this, ensure that your 3CX System has an active internet connection and just refresh the key from the Management Console."

again - do i need to fix anything? our firewall blocks a lot of traffic from 3cx. if i allow everything from 3cx, would that really fix the issue?

thanks guys.

 

[Alejandro_3CX]

Well, the 3CX needs an internet connection and at least allow the traffic to these domains and outbound traffic to 443 TCP:

• activate.3cx.com
• downloads-global.3cx.com

if you are using a 3CX FQDN and the system doesn’t have internet connection, then it will not reach our servers and considered offline releasing the FQDN bounded to the subscription.

 

[itops-care-bears]

thanks Alejandro. so what would be the impact if "considered offline releasing the FQDN bounded to the subscription". will our on-prem 3cx stop to work?

 

[Alejandro_3CX]

No FQDN means there will not be https provisioning, secure access, ssl certificates can’t work with IP address, no webmeeting, no cloud services, no smartphone apps, etc

So it is not supported and not recommended leaving the system without internet connection and out of date.

You can restrict the inbound traffic to the different external ports used by the PBX but at least allow the outbound traffic for the domains above and port 443 TCP.

Check also this document

 

[itops-care-bears]

thanks Alejandro. opened up the ports and i think we are good now.