I installed FreePBX on a brand new Debian 12 server in the cloud. It has a dns name pbx.mycompany.com and I have a wildcard certificate for it.
After install, I put the key, certificate and certificate chain file in the boxes on FreePBX.
When I tried to go to https management, that option was not available and I had to buy enhanced system admin. When I went to buy, every one of my cards was rejected because Sangoma is a Canadian business and it triggered fraud alerts.
So I installed the certificates manually by adding them to /etc/ssl/private and /etc/ssl/certs. I modified the default_ssl.conf.
The https worked. I could do everything but when I went to ucp, i got a node server error because the certificate was not installed internally on FreePBX. By some magic, this time I was able to access https management. I chose the certificate that I had added to the three boxes earlier. It said “installed corrctly” but ucp still doesn’t work and now my server cannot be accessed via either http:// or https://
It was right out of the box. I have a private key, a certificate and a bundle. I installed all of them and https worked. Unfortunately, the UCP was binding to the snakeoil certificate that I had not activated.
It took a lot of effort to get it working but by then, FPBXthought I was a hacker and blocked me from accessing. The server was pretty much dead. SSH didn’t work either.
So then I did some research. FreePBX is really not free. Even basic things one needs for a company require paid modules which cost $1700 per year or $3500 for a 25 year license. However, the 25 year license is deceitful because one still has to buy annual maintenance.
I decided to dump FPBX and went to a commercial PBX which cost <$600 a year and came with all the bells and whistles for a business to run.
Curious about this. Our multi-location retail company has run FreePBX for roughly 8 years now. Haven’t paid a dime for any modules until recently. Only cost until then was AWS hosting. I guess different companies have different requirements. Sounds like a fair amount of paid modules in your case.
If you use wildcard certificates, you will not be able to configure compliant SIPS devices to verify the domain against the certificate.
Most people don’t validate the phone at all, although they might have a specific certificate for the the PABX.
I believe you can white list specific payees with card companies, and maybe even whole countries or business classes.
Whilst there are quite a few complaints that Sangoma have the freemium model set too much towards monetisation, it should be possible to set up basic encryption support with help from the community, but the more you deviate from standard web server Lets Encrypt, the more technical knowledge you will need.