Update to V18-9A failed with SSL Error

[NTSer]

Hi
After Updating to V18 Update 9A i got the browser Error "ERR_SSL_VERSION_OR_CIPHER_MISMATCH"
No luck with restarting nginx and rebooting the whole Pbx.
I think, there is a SSL Cipher issue? But in the nginx config i did not found anything about SSL Ciphers.


Any others, who facing this issue?
Thanks a lot for reply!

Adrian

 

[Alphabetic]

Try another browser?

 

[bitn2]

Did you use 3cx certificate or your own?

 

[NTSer]

I tried different browsers - same behavior

I used my own Certificate - we changed id some weeks ago to ECC Certificate.
but i think this is not a issue....?
before updating to v18 U9a everything was working fine.

 

[bitn2]

Is it an RSA certificate? If not, thats your problem and you need to change it.

 

[NTSer]

We had the ECC Certificate in place with the version before v18 U9a
Did something changed in Version 18 U9a regarding SSL Certificate?

 

[bitn2]

I dont know, but i surely know only RSA certificates are working. All other will have this error you mentioned in your post.

 

[NTSer]

OK
Is this somewhere documented?
Requirements for self shipped corporate Certificates?

 

[bitn2]

No, its my own experience with some customers and some posts in the german forum. All working certificates are RSA.

 

[NTSer]

Thank you for your reply and help!

 

[NTSer]

ECC SSL Certificates are working well, with changing the nginx "ssl_cipher" Settings:
root@3cx:/var/lib/3cxpbx/Bin/nginx/conf/snippets# cat /var/lib/3cxpbx/Bin/nginx/conf/snippets/50-ssl-protocols.conf ssl_protocols TLSv1.2; # OLD one #ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA'; # NEW one ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305';

unfortunately, this setting has to be checked and changed after every update of 3cx.

 

[bitn2]

ECC SSL Certificates are working well, with changing the nginx "ssl_cipher" Settings:
root@3cx:/var/lib/3cxpbx/Bin/nginx/conf/snippets# cat /var/lib/3cxpbx/Bin/nginx/conf/snippets/50-ssl-protocols.conf ssl_protocols TLSv1.2; # OLD one #ssl_ciphers 'TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA'; # NEW one ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305';

unfortunately, this setting has to be checked and changed after every update of 3cx.

Yes, they are working with manual changes. That is not supported.