SSL certificate

[Armor-64]

Hello and good morning!

In our company we have our NFC 3CX PBX (Partners) and we cant connect an sbc becouse of a SSL certificate.
We have the pbx 2-3 years know so as far as i know the certificate is not autorenewed.(all i know free ssl renewal is for one year from 3cx)
Our FQDN is 3cx one.

Is there a proper guide or official way on how to renew and pass a test with ssl hopper so we can connect an SBC? (a guide would help!)
I want to know too is there a free way or payed certificates like godaddy etc?

SBC cant connect without a proper certificate.
We have tryed in other pbx with proper certificates and works just fine.
If anything i am willing to give more information.

P.S

Pbx is in the cloud (Azure) so we want to test sbc becouse we where in stun mode for too long.

Thank you for your time.

 

[Evolute IT]

Your PBX should be renewing the certificate every 90 days on its own as it uses Let's Encrypt. (They don't provide it for 1 year, it's as long as you're licensed.)

 

[Armor-64]

Your PBX should be renewing the certificate every 90 days on its own as it uses Let's Encrypt. (They don't provide it for 1 year, it's as long as you're licensed.)

thnx for replying,

so it was supposed to work automatically but it failed?

as far as i am informed it was downgraded to basic since sales didn't go well and now we are in informed if no sales oure NFR will be downgraded and maybe with the change of version didnt work out?

in anycase i want to know ,on premise and self hosted pbxs do they need to be payed so fqdn cert will be renewed or do we have a way of making a good cert than can work with sbc and stun ip phones?

Sorry for this first time in this field of ssl certs and fqdns ,i want to know the general idea of whats happening so if any customer arises with this problem to be prepared how to fix this on premise or self hosted cloud solutions.

 

[Evolute IT]

thnx for replying,

so it was supposed to work automatically but it failed?

as far as i am informed it was downgraded to basic since sales didn't go well and now we are in informed if no sales oure NFR will be downgraded and maybe with the change of version didnt work out?

in anycase i want to know ,on premise and self hosted pbxs do they need to be payed so fqdn cert will be renewed or do we have a way of making a good cert than can work with sbc and stun ip phones?

Sorry for this first time in this field of ssl certs and fqdns ,i want to know the general idea of whats happening so if any customer arises with this problem to be prepared how to fix this on premise or self hosted cloud solutions.

Even on the basic license level, if the PBX uses a 3CX FQDN (and not a custom one), then the SSL should be handled automatically. Nothing related to NFR or paid licenses would change that.

NFRs do get downgraded if you don't reach partner targets, but that's normal. It drops to a Free Standard 4SC, which would still work perfectly fine.

You'll need to figure out why the SSL isn't renewing. Are you getting any emails regarding SSL or any events in the Event Log?

 

[Armor-64]

If you cant help what do i need to look at the pbx exactly? and can i renew it somehow or do i need to reinstall the pbx or change FQDN?

So if i get it right, if you are using 3cx fqdn any version standar ,PRO or ENT its supposed to work automaticaly and renewed by 3cx?

 

[QueBall]

Updates? Did you leave it running version 16 or something dumb like that? If you are not doing the updates it makes sense, the
Clock on the server, SBC, or client is way out? SSL certificates require reliable time source.
Is someone monitoring the email notifications your PBX generates? It would have sent out emails like "3CX Notifcation: SSL Certificate Renewal Failed" if there were problems renewing the built in SSL certificate.


If you connect and inspect the ssl certificate in a web browser what does it tell you? Does the common name match the server name? Does the expiry date make sense? etc.

The command line to force ssl to perform a renewal
PbxConfigTool.exe -renew-certificates
(path will depend on if you are on Linux or Windows)

On SBC you can use openssl s_client mode to make a connection test.

openssl s_client -connect <hostname>:<port> | more
something like that.

 

[Armor-64]

Updates? Did you leave it running version 16 or something dumb like that? If you are not doing the updates it makes sense, the
Clock on the server, SBC, or client is way out? SSL certificates require reliable time source.
Is someone monitoring the email notifications your PBX generates? It would have sent out emails like "3CX Notifcation: SSL Certificate Renewal Failed" if there were problems renewing the built in SSL certificate.


If you connect and inspect the ssl certificate in a web browser what does it tell you? Does the common name match the server name? Does the expiry date make sense? etc.

The command line to force ssl to perform a renewal
PbxConfigTool.exe -renew-certificates
(path will depend on if you are on Linux or Windows)

On SBC you can use openssl s_client mode to make a connection test.

openssl s_client -connect <hostname>:<port> | more
something like that.

No updates are fine,all on the latest.

I will check in the morning when pbx will wake up (Azure)

Now that i mention it,does certificates renew at exact time? if pbx closes at evening and opens at morning does it block the renewal procedure? meaning that does pbx need to be online 24/7 for updates and renewals etc?

sbc is freshly installed and connected to internet so i dont think its sbc problem,same sbc connected to other pbx.

 

[QueBall]

Yes, the renewal task that would be scheduled to run happens at a random time overnight between 1am and 7am based on what I see in my previous email notifications of renewal.

It causes a small interruption to services (at least it used to, they may have fixed that behaviour though I'm not sure) so it always does it after hours by default.

If you have your VM scheduled to shut down, that would cause all nightly maintenance tasks to fail. It is meant to be left running 24/7. Most people would want their phone numbers to keep working for an IVR and voicemail at night. So it wouldn't be normal to shut down the machine and leave it turned off after business hours.

I'm guessing you did not want to pay for your VM outside of regular hours? You could consider paying for reserved VM prices to get the costs down to a similar price as shutting it down if you commit to 1yr or 3yr terms. For now, leave it running. Perhaps you could automate a shut down and restart on a smaller VM overnight and reboot back into a larger size VM for daytime.

 

[SweetAction]

It causes a small interruption to services (at least it used to, they may have fixed that behaviour though I'm not sure) so it always does it after hours by default.

Should be fixed per https://www.3cx.com/community/threads/update-lets-encrypt-certificate-renewal-time.61901/post-292332

 

[Armor-64]

We freshly re-installed the pbx we keep it 24/7 to see if everything goes smooth,new fqdn and sbc connected just fine.

From what i understand is that pbx need to be online 24/7 to make updates and issue certs it needs.

My own Lab on premise test pbx is 24/7 up no problems and free version so far ,but with the self hosted on work this is where it gets compicated.

I thank you all for your info couse google didnt help much

 

[Evolute IT]

We freshly re-installed the pbx we keep it 24/7 to see if everything goes smooth,new fqdn and sbc connected just fine.

From what i understand is that pbx need to be online 24/7 to make updates and issue certs it needs.

My own Lab on premise test pbx is 24/7 up no problems and free version so far ,but with the self hosted on work this is where it gets compicated.

I thank you all for your info couse google didnt help much

Not sure why your work PBX is offline during certain times. That's not really designed for this.

 

[Armor-64]

Not sure why your work PBX is offline during certain times. That's not really designed for this.

To tell you the truth,boss wants it this way, in this case it the monthly subscription,for 12hours/day monday-friday the cost of azure 40 euro,if we keep it 24/7 open and saturdays and sundays too the cost is going 2x at least.Becouse of the partnership with microsoft as far as i know we cant expand our subscription to 3 years to get better price. I may be wrong dont judge me i am not the owner or the one who is in control of this things. i am a simply employee

 

[Evolute IT]

To tell you the truth,boss wants it this way, in this case it the monthly subscription,for 12hours/day monday-friday the cost of azure 40 euro,if we keep it 24/7 open and saturdays and sundays too the cost is going 2x at least.Becouse of the partnership with microsoft as far as i know we cant expand our subscription to 3 years to get better price. I may be wrong dont judge me i am not the owner or the one who is in control of this things. i am a simply employee

Then use another hosting than Azure? Azure is really expensive, but there's also Lightsail, Vultr and DigitalOcean.

That almost makes no sense since you pay for the VM whether it's on or off. Resources are assigned so you pay for them anyway.

Even 3CX Hosted is cheap enough to run all the time.

 

[SweetAction]

That almost makes no sense since you pay for the VM whether it's on or off. Resources are assigned so you pay for them anyway.

Microsoft Gold partner here - this is a thing. You can have a machine become de-allocated and it will lower billing. You still pay for stuff like storage, but powered off AND deallocated (az vm deallocate) will lower cost as the hardware is no longer "reserved for you".

 

[Evolute IT]

Microsoft Gold partner here - this is a thing. You can have a machine become de-allocated and it will lower billing. You still pay for stuff like storage, but powered off AND deallocated (az vm deallocate) will lower cost as the hardware is no longer "reserved for you".

Interesting. Didn't know they did that.

Still probably cheaper to use another host lol

 

[SweetAction]

Interesting. Didn't know they did that.

Still probably cheaper to use another host lol

For sure some hosts like Vultr would be cheaper. But of the "big 3" (GCP, AWS, Azure), Azure is usually the cheapest. And some customers insist on the big 3 (or more usually, they insist on a specific one).

 

[Armor-64]

For sure some hosts like Vultr would be cheaper. But of the "big 3" (GCP, AWS, Azure), Azure is usually the cheapest. And some customers insist on the big 3 (or more usually, they insist on a specific one).

Same here we are partners and we recomend to use azure for safety,redudancy etc,mostly cloud services,but for us to cut down the cost down couse we use the free 150euro per month(as partners) and to have the rest for research purposes we are closing the VM down for cost clearly.