3CX: Using Your Own FQDN & SSL Certificate

Author: Kevin Fortune
Version: Applies to 3CX v18 & v20

Introduction

The 3CX PBX can be installed using 3CX-provided FQDN and SSL certificates at no extra cost. However, if you prefer to use your own domain name and manage your SSL certificate centrally, this article will guide you through that process.

Prerequisites

• You must own a public domain name (e.g., mycompany.com).
• You must control public DNS for the domain (e.g., via Google Cloud DNS or other DNS provider).
• You must have an FQDN for your PBX (e.g., pbx.mycompany.com).

Publicly Trusted Certificates

3CX issues certificates for its provided domains. If you’re using your own certificate, you must ensure it is trusted by all endpoints including browsers, IP phones and soft clients. Check that the Certificate Authority (CA) and its intermediate certificates are supported by your devices. Some IP phones may require custom CA trust chains to be imported. Reference: the 3CX documentation for more details.

Obtaining and Installing Your Own Certificate

Follow these high-level steps:

1. Select a certificate authority (CA) you trust (e.g., Let’s Encrypt, DigiCert, GoDaddy).
2. Ensure the CA issues a certificate strap compatible with all your clients (including IP phones).
3. Generate the certificate for your FQDN and include all necessary SANs (Subject Alternative Names).
4. Import the certificate and intermediate CA chain on your 3CX PBX server.
   Example for Linux Debian server:
   cat your_cert.crt chain.pem your_private.key > pbx_cert.pem
5. In the 3CX Management Console, go to Settings → Security → SSL/TLS, then upload the combined certificate file and select your FQDN.

Using the 3CX Wizard to Change FQDN

If you’re retaining your existing PBX but want to change the FQDN, use the 3CX FQDN change wizard. Go to Dashboard → FQDN Management → Change, then upload your certificate and apply the change. 3CX will automatically reload services and regenerate provisioning links.

Important Notes & Warnings

• Upgrading OS versions with 3CX may break certificate chains—always verify after OS upgrades.
• If your phones or clients display certificate errors, check root/intermediate CAs and phone firmware updates.
• Remember to renew or replace your certificate before expiry to avoid service disruption.

Need Assistance?

If you require help configuring or migrating your PBX’s FQDN/SSL setup, Deerfield’s 3CX-certified team is available for consulting and support.

← Back to 3CX Articles