TIPS IncrediblePBX 2020/2021, Let's Encrypt and PJSIP TLS ?

[n9yty]

I started poking at this a bit, having set up certbot to get/renew certificates for the web interface, and wanted to see about getting them where FreePBX could use them for TLS...

I have TLS set up with the FreePBX/asterisk generated ones, but some softphone clients I have tried don't like private certs.

I was wondering if anyone had done anything to handle certbot renewals and updating the certs in FreePBX and restarting it or signaling it to re-read the certs from disk.

Even doing the "import from file system" took a bit of doing, and I couldn't quite get symlinks to work on my first try due to filesystem permissions. I may have overlooked something and may revisit it, but it never hurts to ask after you've already given it at least one good effort.

Sorry for the noise if I'm missing something obvious.

 

[n9yty]

I found some notes here that may be on the right path, I'm going to test them. Apparently doing things using fwconsole can work with the links even if the web GUI can not. Strange.

Letsencrypt certificates - two domains (pbx.example.com, pbx5.example.com)

<Pedantic mode> Those are not two domains - it is one domain with two host names. Either way, if you aren’t using a “wildcard” cert, the hostnames must match the server they are servicing. If your host has two hostnames, both need certs unless you are using wildcards. </Pedantic mode> Sorry...

community.freepbx.org

Putting that into the renew hook for certbot should work, but time will tell.

 

[mrzeus]

@n9yty By any chance do you have a step by step to setup certbot to get https on the freepbx admin site?, I'm getting this error, I've tried to open my server to listen on port 443 but apparently I'm doing something wrong

 Timeout during connect (likely firewall problem)

 

[mainenotarynet]

Open port 80 -- when certbot does its thing, it check http not https so its port 80 its looking for.

I believe they also have a dns record check method where it looks for a certain record that you put in. in this way it knows you are in control of the domain. In all my domains I have a record like this:

<thedomainname.tld>. CAA 128 issue "letsencrypt.org"

But with the free PBX part it may be required to open 80. I may also be talking out my @$$ - I'm no guru.

 

[wardmundy]

Turn off the firewall long enough to do the install or update. Then iptables-restart.

 

[JFrost]

Open port 80 -- when certbot does its thing, it check http not https so its port 80 its looking for.

I believe they also have a dns record check method where it looks for a certain record that you put in. in this way it knows you are in control of the domain. In all my domains I have a record like this:

<thedomainname.tld>. CAA 128 issue "letsencrypt.org"

But with the free PBX part it may be required to open 80. I may also be talking out my @$$ - I'm no guru.

acme-DNS is the way. I haven't done it on my freepbx server but have on a number of other servers where I'm not running port 80 or just don't want it exposed to the 'Net.
You put up a specialized text record in DNS proving you own the domain and renewals proceed as planned forever.

 

[n9yty]

I opened port 80 but put in restrictions so it can only access the resources that Let's Encrypt needs. It has to be open for future renewals... I suppose if there was a pre-renwal but I could hook in there, but we are running this in Azure and I'm using their firewall as well, as I can access that from the web even if iptables has blocked me or needs to be updated.

I wish I could do the DNS bit, but this domain is on namecheap which I don't believe is eligible for the REST API access, they have some strange requirements for it.

 

[dhoppy]

have you looked at the script @jerrm wrote?

https://www.voip-info.org/forum/threads/lets-encrypt-issue.25246/

 

[jerrm]

this domain is on namecheap which I don't believe is eligible for the REST API

Not sure of the functionality, but acme.sh has a namecheap dns plugin.

Acme.sh is my preferred acme client. A single shell script with no special dependencies.

If I get off my a** to finish it up, and the FreePBX folks accept the PR, the certman module will be acme.sh backed and support dns-01 auth "soon."

 

[KNERD]

I opened port 80 but put in restrictions so it can only access the resources that Let's Encrypt needs. It has to be open for future renewals... I suppose if there was a pre-renwal but I could hook in there, but we are running this in Azure and I'm using their firewall as well, as I can access that from the web even if iptables has blocked me or needs to be updated.

In the firewall module, under Advanced Settings there is an option for that

 

[n9yty]

In incrediblepbx? I don't see any firewall module, must be going blind.