3CX and Lets Encrypt

[mdrabble]

Not sure if this is the right place to post this - Mods, please move if needed :-)

 

Have 3CX running on Server 2019 and normally I wouldnt bother with a certificate as I am normally the only one accessing it, but since lockdown, I have needed some staff to access the webclient.

 

Downloaded latest version of Win-Acme but I cannot do http test as port 80 isnt open, plus 3CX doesn't use port 80 for anything, so this leave me with DNS verification.

 

Instead of adding the DNS TXT to our external DNS and wait for things to replicate - I wondered if I could cheat and use Windows DNS and add the TXT

 

 

I already have our external domain name as a DNS Zone on our internal servers so names point to internal IP Addresses.

 

Added ServerName as a new domain so I now have Server.DOMAIN as a Zone.

 

I tried adding _acme-challenge as a TXT record and also tried added _acme-challenge as a Domain do I then have _acme-challenge.server.domain and then added the TXT record

 

Neither of which work......

 

Any one else use 3CX (Windows) and Lets Encrypt - if so how do you do the SSL?

 

Cheers

[TechMonkey]

I've not done it but wanted to. The last time I looked I think it could only be done if you had an instance hosted by 3CX, or their FQDN, instead of a custom one.

 

EDIT: Have just found this which is newer than when I last looked, so looks like it may be possible.

Edited June 11, 2020 by TechMonkey

[dhicks]

Any one else use 3CX (Windows) and Lets Encrypt - if so how do you do the SSL?

 

This is going to depend on your setup and your own preferences, but for SSL services in general I've found the simplest solution to be to use an Nginx instance on a separate VM as a reverse proxy. You can put several different services behind one SSL-enabled gateway if wanted (https://services.yourschool.com/3cx, https://services.yourschool.com/cctv, etc) and Let's Encrypt have a nice auto-configuring setup for Nginx.

[mdrabble]

I've not done it but wanted to. The last time I looked I think it could only be done if you had an instance hosted by 3CX, or their FQDN, instead of a custom one.

 

EDIT: Have just found this which is newer than when I last looked, so looks like it may be possible.

 

Will take a look at those and see if I can get it to work.

[mdrabble]

This is going to depend on your setup and your own preferences, but for SSL services in general I've found the simplest solution to be to use an Nginx instance on a separate VM as a reverse proxy. You can put several different services behind one SSL-enabled gateway if wanted (https://services.yourschool.com/3cx, https://services.yourschool.com/cctv, etc) and Let's Encrypt have a nice auto-configuring setup for Nginx.

 

Wouldn’t even know where to start with setting up this - especially with smoothwalll in the mix

[pete]

DNS records/zone for verification have to be publicly available to respond to requests. Otherwise any herbert could add Google.com to internal DNS and get a Let's Encrypt cert for Google.com.

 

If the current host of your external DNS records supports it, you can script DNS verification to automatically create records, query them, issue the cert and then remove the records.

 

Cloudflare example: https://www.win-acme.com/reference/plugins/validation/dns/cloudflare

[andy_b]

Wouldn’t even know where to start with setting up this - especially with smoothwalll in the mix

 

I use https://nginxproxymanager.com/ at home / work for a few things - seems to work ok if you don't wish to dabble with nginx configs.

[DavidYoung]

3CX has lets encrypt support built in based on thier own domains (e.g. ours is xxx.3cx.eu). The server manages and renews its certificate automatically. For access within the network, we simply created another DNS zone with the full FQDN of the server based on the 3CX domain CNAME'd back to the internal FQDN of the server. Works well.

[mdrabble]

We use a customer URL so not able to use their SSL certs.

 

Ended up adding TXT verification code to external DNS waiting for about 5 mins and then created the certificate.

 

Bit of a faff but at least it is done for now and will need to repeat later on in August should I need staff to access web client again.

[dhicks]

Bit of a faff but at least it is done for now and will need to repeat later on in August should I need staff to access web client again.

 

I came accross this service a few weeks ago:

 

https://tunnelto.dev/

 

Allows you to tunnel a port through a firewall, complete with HTTPS managed for you - so you go to https://someurl.tunnelto.dev, your traffic gets forwarded to your server behind your firewall. Cross-platform, seems to work nicely on Windows, you just need to install it using NSSM if you want it to act as a service.

[hubertg]

Hi! How do you use the 3CX server with nginx? I mean, how do you forward all the ports needed by 3cx, using only one subdomain? Thank you!