SSL Questions

[cobaltit]

First of all, I want to say that it is awesome that 3CX incorporated Let's Encrypt.

It looks like if you let 3CX create your own FQDN a Let's Encrypt certificate is generated, but if you specify your own FQDN the installer wants you to provide the cert. It would be nice if you also had the option to let 3CX create a Let's Encrypt cert using your own FQDN as well. I just used https://zerossl.com to create a certificate and then provided that to the installer.

I just noticed this in my event log:

But in looking at my certificate, it doens't appear to have been renewed:

Now being that I used my own FDQN and manually supplied the certificate I wouldn't expect 3CX to manage it. But it appears it is trying to manage/renew it and logging it, albeit incorrectly.

 

[andreaschr]

Hi cobaltit,

Thank you for your attention to this matter , it is very important for as to give the maximum security for our clients .

Yes it will be nice if we could Generate Certificates for your domain but there are some issues .
First you need to have the port 80 open and a lot of users are using 5000 , 5001 so the acme challenge will fail . Let's Encrypted for Security Reasons do not allow authorization for random ports only 80 and 443.
Second normal Domains have some Limitations (ex. 20 Certificate per Domain).
Like you set is easy to Generate by yourself the certificate and import it .

Regarding the Event log is fixed in the RC build.

 

[cobaltit]

Hey Andreaschr,
Understand about the port but it would still be nice to either have the option (with the requirement of being setup on port 80 which was previously forced upon us for v14) or optionally to use the DNS auth method for Let's Encrypt authentication.

On another SSL related note, I installed the RC and even though I was restoring from my backup it still wanted me to manually point to the cert and key as if I was doing a brand new install. Shouldn't these be pulled from the backup?

 

[NickD_3CX]

No, during the installation a new Cert is required, but there is some interesting information here:
http://www.3cx.com/forums/fqdn-and-ssl-cert-45242.html