SSL VPN Certificates - issue and renewal - Debian

[CSerpent]

I spent a whack of time earlier this week trying to piece together the correct way to renew the SSL cert for our full non-3CX-FQDN server. For the benefit of others, I just wanted to share the procedure of how to sort your own SSL cert. We use thesslstore for our cert, but so long as your provider issues PEM certs, you should be fine.

--

SSH into your server and elevate to root

cd /var/lib/3cxpbx/Bin/nginx/conf/Instance1

openssl req -new -newkey rsa:2048 -nodes -keyout [your.fqdn].key -out [your.fqdn].csr

Fill in details, issue CSR to SSL provider, authorise issue.

Download Individual .crt files with a .pem extension, extract files

Upload extracted files via WinSCP / FileZilla / client of your choice to /var/lib/3cxpbx/Bin/nginx/conf/Instance1

mv [your.fqdn].key [your.fqdn]-key.pem
mv [your.fqdn].pem [your.fqdn]-crt.pem

systemctl restart nginx

--

I hope that helps anyone encountering this issue.

 

[SweetAction]

Make sure to include the full chain (or at the least the intermediate certs) in your final pem files..

I wrote this up a while ago: https://www.3cx.com/community/threads/update-renew-certificate.77468/post-356117

 

[CSerpent]

Make sure to include the full chain (or at the least the intermediate certs) in your final pem files..

I wrote this up a while ago: https://www.3cx.com/community/threads/update-renew-certificate.77468/post-356117

Thanks SweetAction - searches weren't coming up with this post when I was searching earlier in the week. Thanks for linking.