Renewing Let's Encrypt certificate for SIP TLS (5061) without restarting BSS?

1. Brekeke Product Name and Version:
Brekeke SIP Server Advanced Edition 3.18.1.0

2. Java version:
11.0.29

3. OS type and the version:
Ubuntu 22.04 LTS

4. UA (phone), gateway or other hardware/software involved:
Yealink T46U and Grandstream GRP2613 phones registering over TLS (5061), a few softphones over WSS. Certificate is issued by Let's Encrypt with certbot.

5. Your problem:
We use a Let's Encrypt certificate for SIP over TLS and WSS. Since the certificate expires every 90 days, we currently do the following each time:

1. certbot renew
2. convert fullchain.pem + privkey.pem into a PKCS12/JKS keystore with openssl/keytool
3. upload the keystore on [Configuration] > [Certificate] (or replace the file)
4. restart the SIP Server

Step 4 drops all TLS/WSS registrations for a moment, so we would like to avoid it.

Questions:
- After replacing the keystore, does BSS pick up the new certificate automatically, or is a restart always required?
- If a restart is not required, is there a command or setting to reload the certificate (for example from the console or the REST API)?
- Does BSS have any built-in ACME / Let's Encrypt support that can renew the certificate by itself, so we don't need certbot and the conversion step?
- Are existing TLS connections kept when the certificate is reloaded, or do the phones need to re-register?

Any pointers to the relevant documentation would be appreciated.

Thanks,
Ken

Hi Ken,

A restart is not required.

Upload the renewed certificate on [SIP Server] > [Configuration] > [Key/Certificate] (version 3.17 or later) and it is applied without restarting the SIP Server.

You can also skip step 2. Select the "Certificate and Key" file type and upload fullchain.pem and privkey.pem directly, so the openssl/keytool conversion is not needed.

Existing TLS/WSS connections are kept. The new certificate is used for new connections, and the phones pick it up when they reconnect or re-register.

References:
https://docs.brekeke.com/sip/key-and-certificate
https://docs.brekeke.com/sip/get-free-c ... ts-encrypt

Hi Ericcc,

Thank you, that solved it.

I renewed the certificate with certbot, uploaded fullchain.pem and privkey.pem on [Configuration] > [Key/Certificate] with the "Certificate and Key" file type, and the new certificate was in use right away without a restart. The phones stayed registered, and after their next re-registration the new expiry date showed up on the handsets.

It is also good to know that the openssl/keytool conversion is no longer needed. That removes two steps from our renewal procedure.

Thanks again for the quick and clear answer.

Ken