Wildcard certificate *.domain.ch

[lucpac]

Hello
I migrated V18 to V20, I did not update the certificate on the new V20, it was restored from V18 and valid till oct 2026, now the provisioning (port 443) work only if I disable "Only Accept Trusted Certificates" under Trusted certificates on the phones yealink T48U for example, maybe this is caused by wildcard certificate in V20 Only?
I also installed the intermediate certificate and the chain seems good when doing "openssl s_client -connect pbx.domain.ch:443 -showcerts"
Thank you!

 

[Charles_3CX]

Hi, please check the CA cert that you have in the Pem and ensure to also add the intermediate as well as the root certificate.

As the one you have is a root certificate

Issuer: Sectigo Public Server Authentication Root R46

 

[lucpac]

Hi,you mean to put all 3 in the pem > C:\ProgramData\3CX\Bin\nginx\conf\Instance1\domain_cert_pbx.xxxxxx.ch.pem?

I already put the *.xxx.ch and the sectigo intermediate, If I understand right I have to put also the root like so:

wildcard *.xxxx.ch

-----BEGIN CERTIFICATE-----
...............
-----END CERTIFICATE-----

Sectigo Public Server Authentication CA OV R36

-----BEGIN CERTIFICATE-----
...............
-----END CERTIFICATE-----

Sectigo Public Server Authentication Root R46

-----BEGIN CERTIFICATE-----
...............
-----END CERTIFICATE-----

 

[Charles_3CX]

The structure should be as follows.

-----BEGIN CERTIFICATE-----

FQDN certificate

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

Intermediate certificate

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

Root certificate

-----END CERTIFICATE-----

 

[lucpac]

Hello
Thank you very much. It is working.
If I understand correctly, my problem comes out from the wildcard type of the certificate, if I use the regular one, there is no need to put the intermediate and the root certificate in the pem
Best regards
Sincerely

Luca

 

[Charles_3CX]

There is always a need for the intermediate; the wildcard does not cause it.