TIPS Let's encrypt certs on IncrediblePBX server

[cantVOIP]

Hello everyone.

Specs IncrediblePBX 2021 15.0.37 on VMWare.

I'd like to install let's encrypt on the server and use DNS Challenge to generate the certificate, key, and get the CA for my domain pxb.mydomain.com. I believe let's encrypt will create a folder and place the certs in that specific place.
I also remember that after uploading the certificate, key, trusted chain, you need to select it as default on the GUI. And you need to specify which certificate manage to use under Settings/Asterisk SIP Settings/SIP Settings [chan_pjsip]/TLS/SSL/SRTP Settings (Certificate Manager)

Can anyone please tell me which IncrediblePBX file using the terminal do I have to point to the let's encrypt certificate? I have so far been creating my own certificates manually and uploading it through the GUI. I'd like to automate this.

Thank you in advanced!

 

[dicko]

Hello everyone.

Specs IncrediblePBX 2021 15.0.37 on VMWare.

I'd like to install let's encrypt on the server and use DNS Challenge to generate the certificate, key, and get the CA for my domain pxb.mydomain.com. I believe let's encrypt will create a folder and place the certs in that specific place.
I also remember that after uploading the certificate, key, trusted chain, you need to select it as default on the GUI. And you need to specify which certificate manage to use under Settings/Asterisk SIP Settings/SIP Settings [chan_pjsip]/TLS/SSL/SRTP Settings (Certificate Manager)

Can anyone please tell me which IncrediblePBX file using the terminal do I have to point to the let's encrypt certificate? I have so far been creating my own certificates manually and uploading it through the GUI. I'd like to automate this.

Thank you in advanced!

It's the other-way around, FreePBX will always look for certs in /etc/asterisk/keys , they should be named pxb,domain.com.crt and pxb.mydomain.com.key and be in PEM format.

I don't think the Acme client that FreePBX uses can do DNS01 challenge but I have never had a problem with

GitHub - acmesh-official/acme.sh: A pure Unix shell script ACME client for SSL / TLS certificate automation

A pure Unix shell script ACME client for SSL / TLS certificate automation - acmesh-official/acme.sh

github.com

Which supports over 100 common name servers for automatic DNS01 certs.

Example using DigitalOcean Name Server where /root/.acme.sh/acme.sh.env contains your API key


export DO_API_KEY="ed51b6dd5de788910c76abc55150dea836294d8f9348560d16e12e853de3c6234"
export LE_WORKING_DIR="/root/.acme.sh"
alias acme.sh="/root/.acme.sh/acme.sh"


then to issue

acme.sh -i --cert-file /etc/asterisk/keys/pxb.domain.com.crt --key-file /etc/asterisk/keys/pxb.domain.com.key --fullchain-file /etc/asterisk/keys/pxb.domain.com.pem --reloadcmd "fwconsole cert --updateall" -d pxb.domain.com --dns dns_dgon

 

[cantVOIP]

It's the other-way around, FreePBX will always look for certs in /etc/asterisk/keys , they should be named pxb,domain.com.crt and pxb.mydomain.com.key and be in PEM format.

I don't think the Acme client that FreePBX uses can do DNS01 challenge but I have never had a problem with

GitHub - acmesh-official/acme.sh: A pure Unix shell script ACME client for SSL / TLS certificate automation

A pure Unix shell script ACME client for SSL / TLS certificate automation - acmesh-official/acme.sh

github.com

Which supports over 100 common name servers for automatic DNS01 certs.

Example using DigitalOcean Name Server where /root/.acme.sh/acme.sh.env contains your API key


export DO_API_KEY="ed51b6dd5de788910c76abc55150dea836294d8f9348560d16e12e853de3c6234"
export LE_WORKING_DIR="/root/.acme.sh"
alias acme.sh="/root/.acme.sh/acme.sh"


then to issue

acme.sh -i --cert-file /etc/asterisk/keys/pxb.domain.com.crt --key-file /etc/asterisk/keys/pxb.domain.com.key --fullchain-file /etc/asterisk/keys/pxb.domain.com.pem --reloadcmd "fwconsole cert --updateall" -d pxb.domain.com --dns dns_dgon

Thank for your reply.

Did you have to make a change to your IPtables in the PBX?

I'm having some issues downloading certbot. I'm running "
sudo apt install certbot python3-certbot-dns-route53"

It takes a little while and then I get these kind of errors for all packages:

Could not connect to debian.gtisc.gatech.edu:80 (128.61.240.89), connection timed out
Err:2 http://debian.gtisc.gatech.edu/debian buster/main amd64 python3-asn1crypto all 0.24.0-1
Unable to connect to debian.gtisc.gatech.edu:http:

 

[dicko]

Thank for your reply.

Did you have to make a change to your IPtables in the PBX?

I'm having some issues downloading certbot. I'm running "
sudo apt install certbot python3-certbot-dns-route53"

It takes a little while and then I get these kind of errors for all packages:

Could not connect to debian.gtisc.gatech.edu:80 (128.61.240.89), connection timed out
Err:2 http://debian.gtisc.gatech.edu/debian buster/main amd64 python3-asn1crypto all 0.24.0-1
Unable to connect to debian.gtisc.gatech.edu:http:

As I said I don't use Certbot. This was a recipe for an alternate acme client called acme.sh it will issue certs from ZeroSSL by default but if you insist, you can choose LetsEncrypt after RTFM

As root,

git clone https://github.com/acmesh-official/acme.sh

 

[cantVOIP]

As I said I don't use Certbot. This was a recipe for an alternate acme client called acme.sh it will issue certs from ZeroSSL by default but if you insist, you can choose LetsEncrypt after RTFM

As root,

git clone https://github.com/acmesh-official/acme.sh

Thank you for the suggestion. I ended up fixing that issue from the prior reply.

I had to replace the /etc/apt/sources.list content to the following:
# Official Debian Buster repositories

deb http://deb.debian.org/debian/ buster main contrib non-free

deb-src http://deb.debian.org/debian/ buster main contrib non-free



# Security updates

deb http://security.debian.org/debian-security buster/updates main contrib non-free

deb-src http://security.debian.org/debian-security buster/updates main contrib non-free



# Buster updates

deb http://deb.debian.org/debian/ buster-updates main contrib non-free

deb-src http://deb.debian.org/debian/ buster-updates main contrib non-free



# Webmin repository (you can keep this if necessary for Webmin)

deb http://download.webmin.com/download/repository sarge contrib