Install a Comodo/Sectigo Domain Validation SSL certificate in Zimbra

Objective: Install a Comodo/Sectigo Domain Validation (DV) SSL certificate in Zimbra.

We usually get the below four files from Sectigo in the certificate bundle. The file name may vary depending on the certificate type

1.    yourdomain.com.crt - main certificate

2.    AAACertificateServices.crt – Root Certificate

3.    USERTrustRSAAAACA.crt – Intermediate Certificate - 1

4.    SectigoRSADomainValidationSecureServerCA.crt - Intermediate Certificate - 2

Step 1: We shall create two files as below.

  • commercial_ca.crt (includes root certificate and two intermediate certificates)
  • commercial.crt (includes main certificate, root certificate and two intermediate certificates)

Step 2: Login to Zimbra server, move to directory /opt/zimbra/ssl/zimbra/commercial and create two files as below.

root@mail:~# cd /opt/zimbra/ssl/zimbra/commercial/

root@mail:/opt/zimbra/ssl/zimbra/commercial# touch commercial_ca.crt

root@mail:/opt/zimbra/ssl/zimbra/commercial# touch commercial.crt

 

Step 3: Provide ownership to Zimbra.

root@mail:/opt/zimbra/ssl/zimbra/commercial# chown zimbra:zimbra commercial_ca.crt

root@mail:/opt/zimbra/ssl/zimbra/commercial# chown zimbra:zimbra commercial.crt

 

Step 4: Add the certificates into respective files as mentioned above.

root@mail:/opt/zimbra/ssl/zimbra/commercial# vim commercial_ca.crt

-----BEGIN CERTIFICATE-----

<root certificate is here>

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

<intermediate certificate 1 is here>

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

<intermediate certificate 2 is here>

-----END CERTIFICATE-----

 

root@mail:/opt/zimbra/ssl/zimbra/commercial# vim commercial.crt

-----BEGIN CERTIFICATE-----

<main certificate is here>

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

<root certificate is here>

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

<intermediate certificate 1 is here>

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

<intermediate certificate 2 is here>

-----END CERTIFICATE-----

 

Step 5: Execute below command as Zimbra user to verify the certificate.

zimbra@mail:~/ssl/zimbra/commercial$ /opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/zimbra/ssl/zimbra/commercial/commercial.crt /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt

 

The output of this command shall look like below.

** Verifying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'

Certificate '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.

** Verifying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt'

Valid certificate chain: /opt/zimbra/ssl/zimbra/commercial/commercial.crt: OK

We shall not proceed further if we get any error here. We have to resolve the error first and then install the certificate following step 6.

 

Step 6: Install the certificate.

zimbra@mail:~/ssl/zimbra/commercial$ /opt/zimbra/bin/zmcertmgr deploycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.crt /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt

The output should look like below.

** Keeping first certificate in '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'

** Verifying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'

Certificate '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.

** Verifying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt'

Valid certificate chain: /opt/zimbra/ssl/zimbra/commercial/commercial.crt: OK

** Appending ca chain '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'

** Importing cert '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' as 'zcs-user-commercial_ca' into cacerts '/opt/zimbra/common/lib/jvm/java/jre/lib/security/cacerts'

** NOTE: restart mailboxd to use the imported certificate.

** Saving config key 'zimbraSSLCertificate' via zmprov modifyServer mail.outpacebd.com...ok

** Saving config key 'zimbraSSLPrivateKey' via zmprov modifyServer mail.outpacebd.com...ok

** Installing imapd certificate '/opt/zimbra/conf/imapd.crt' and key '/opt/zimbra/conf/imapd.key'

** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/imapd.crt'

** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/imapd.key'

** Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'

** Creating keystore '/opt/zimbra/conf/imapd.keystore'

** Installing ldap certificate '/opt/zimbra/conf/slapd.crt' and key '/opt/zimbra/conf/slapd.key'

** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/slapd.crt'

** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/slapd.key'

** Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'

** Creating keystore '/opt/zimbra/mailboxd/etc/keystore'

** Installing mta certificate '/opt/zimbra/conf/smtpd.crt' and key '/opt/zimbra/conf/smtpd.key'

** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/smtpd.crt'

** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/smtpd.key'

** Installing proxy certificate '/opt/zimbra/conf/nginx.crt' and key '/opt/zimbra/conf/nginx.key'

** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/nginx.crt'

** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/nginx.key'

** NOTE: restart services to use the new certificates.

** Copying CA to /opt/zimbra/conf/ca

** Copying '/opt/zimbra/ssl/zimbra/ca/ca.key' to '/opt/zimbra/conf/ca/ca.key'

** Copying '/opt/zimbra/ssl/zimbra/ca/ca.pem' to '/opt/zimbra/conf/ca/ca.pem'

** Creating CA hash symlink 'a23bec5a.0' -> 'ca.pem'

** Creating /opt/zimbra/conf/ca/commercial_ca_1.crt

** Creating CA hash symlink 'ee64a828.0' -> 'commercial_ca_1.crt'

** Creating /opt/zimbra/conf/ca/commercial_ca_2.crt

** Creating CA hash symlink '65ff7287.0' -> 'commercial_ca_2.crt'

** Creating /opt/zimbra/conf/ca/commercial_ca_3.crt

** Creating CA hash symlink 'fc5a8f99.0' -> 'commercial_ca_3.crt'


Step 7: Restart Zimbra service to take effect the changes.

zimbra@mail:~$ zmcontrol restart

Hope this helps .

Comments

Post a Comment

Popular posts from this blog

Adding DKIM record (1024 bit) in Zimbra

Image
Email security is very important now a days. We always look for inbound email security. However, it is very much important to enhance security for outbound emails too for successful email delivery to the recipient inbox. DomainKeys Identified Mail (DKIM) provides an organization to take responsibility for a message that is in transit. The sending server reputation is responsible for successful email delivery. DKIM provides the message is not being altered in the transmission of message till delivery of it. Technically DKIM provides a method for validating a domain name identity that is associated with a message through cryptographic authentication. In some cases, we have generate 1024 bit DKIM key due to old Zimbra version or lack of support 2048 bit key in DNS servers. The below steps should be performed to achieve the goal of publishing 1024 bit DKIM key. Generate DKIM Key: DKIM signing is done at the domain level, including alias domains. Setting up signing consists of two p...
Read more

Recipient Limit of a Message in Zimbra

Image
We received some complaints from one of our customers regarding problem of sending email, especially rate limit, to Gmail. After some diagnosis, we found that the users keep 70-80 email addresses in TO/CC/BCC. In order to restrict users to send emails on such accounts at a time, we implemented a policy. After executing this policy, users shall not be able to add more than 10 email addresses in a message. root@mail:~# su – zimbra Check the current limit: zimbra@mail:~$ postconf | grep smtpd_recipient_limit  smtpd_recipient_limit = 1000     ##This is the default recipient limit zimbra@mail:~$ postconf -e 'smtpd_recipient_limit = 10'   It will restrict the recipient limit to 10. You may adjust the number based on your scenario. To apply settings. zimbra@mail:~$ postfix reload After applying this settings, you will get an error while sending a message greater than the threshold value (in this case: 10). It is also t...
Read more