Zimbra Creating self-signed certifiate
\nUCSC Zimbra
\n===========<\/p>\n
Backup Existing Commertical Certs
\n———————————<\/p>\n
# cd \/opt\/zimbra\/ssl\/zimbra\/commercial\/
\n# mkdir -p DigiCert_old
\n# cp commercial* .\/DigiCert_old<\/p>\n
# cd \/opt\/zimbra\/ssl\/zimbra\/server
\n# mkdir -p Server_old
\n# cp server.* Server_old<\/p>\n
# cd \/opt\/zimbra\/bin
\nCreating a CA
\n————-<\/p>\n
# .\/zmcertmgr createca -new
\n** Creating \/opt\/zimbra\/ssl\/zimbra\/ca\/zmssl.cnf…done
\n** Creating CA private key \/opt\/zimbra\/ssl\/zimbra\/ca\/ca.key…done.
\n** Creating CA cert \/opt\/zimbra\/ssl\/zimbra\/ca\/ca.pem…done.<\/p>\n
Creating Certs
\n————–<\/p>\n
# .\/zmcertmgr createcrt -new -days 365
\nValidation days: 365
\n** Creating \/opt\/zimbra\/conf\/zmssl.cnf…done
\n** Backup \/opt\/zimbra\/ssl\/zimbra to \/opt\/zimbra\/ssl\/zimbra.20110423123012
\n** Generating a server csr for download self -new -keysize 1024
\n** Creating \/opt\/zimbra\/conf\/zmssl.cnf…done
\n** Backup \/opt\/zimbra\/ssl\/zimbra to \/opt\/zimbra\/ssl\/zimbra.20110423123012
\n** Creating server cert request \/opt\/zimbra\/ssl\/zimbra\/server\/server.csr…done.
\n** Saving server config key zimbraSSLPrivateKey…failed.
\n** Signing cert request \/opt\/zimbra\/ssl\/zimbra\/server\/server.csr…done.
\nDeploy the certificate
\n———————-<\/p>\n
#.\/zmcertmgr deploycrt self
\n** Saving server config key zimbraSSLCertificate…failed.
\n** Saving server config key zimbraSSLPrivateKey…failed.
\n** Installing mta certificate and key…done.
\n** Installing slapd certificate and key…done.
\n** Installing proxy certificate and key…done.
\n** Creating pkcs12 file \/opt\/zimbra\/ssl\/zimbra\/jetty.pkcs12…done.
\n** Creating keystore file \/opt\/zimbra\/mailboxd\/etc\/keystore…done.
\n** Installing CA to \/opt\/zimbra\/conf\/ca…done.
\nDeploy the CA
\n————-<\/p>\n
# .\/zmcertmgr deployca
\n** Importing CA \/opt\/zimbra\/ssl\/zimbra\/ca\/ca.pem into CACERTS…done.
\n** Saving global config key zimbraCertAuthorityCertSelfSigned…failed.
\n** Saving global config key zimbraCertAuthorityKeySelfSigned…failed.
\n** Copying CA to \/opt\/zimbra\/conf\/ca…done.
\nVerify the certificate was deployed to all the services
\n——————————————————-<\/p>\n
# .\/zmcertmgr deployca
\n** Importing CA \/opt\/zimbra\/ssl\/zimbra\/ca\/ca.pem into CACERTS…done.
\n** Saving global config key zimbraCertAuthorityCertSelfSigned…failed.
\n** Saving global config key zimbraCertAuthorityKeySelfSigned…failed.
\n** Copying CA to \/opt\/zimbra\/conf\/ca…done.
\nView the Certificate
\n——————–<\/p>\n
debian-zimbra:\/opt\/zimbra\/bin# .\/zmcertmgr viewdeployedcrt
\n::service mta::
\nnotBefore=Apr 23 07:00:14 2011 GMT
\nnotAfter=Apr 22 07:00:14 2012 GMT
\nsubject= \/C=US\/ST=N\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk
\nissuer= \/C=US\/ST=N\/A\/L=N\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk
\nSubjectAltName=
\n::service proxy::
\nnotBefore=Apr 23 07:00:14 2011 GMT
\nnotAfter=Apr 22 07:00:14 2012 GMT
\nsubject= \/C=US\/ST=N\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk
\nissuer= \/C=US\/ST=N\/A\/L=N\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk
\nSubjectAltName=
\n::service mailboxd::
\nnotBefore=Apr 23 07:00:14 2011 GMT
\nnotAfter=Apr 22 07:00:14 2012 GMT
\nsubject= \/C=US\/ST=N\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk
\nissuer= \/C=US\/ST=N\/A\/L=N\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk
\nSubjectAltName=
\n::service ldap::
\nnotBefore=Apr 23 07:00:14 2011 GMT
\nnotAfter=Apr 22 07:00:14 2012 GMT
\nsubject= \/C=US\/ST=N\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk
\nissuer= \/C=US\/ST=N\/A\/L=N\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk
\nSubjectAltName=
\n==============================================================================================================
\n== – ZMCERTMGR Help – ==
\n==============================================================================================================<\/p>\n
.\/zmcertmgr -help
\n.\/zmcertmgr createca [-new] [-keysize 1024] [-subject subject]
\n.\/zmcertmgr deployca
\n.\/zmcertmgr createcsr <self|comm> [-new] [-keysize 1024] [-subject subject] [-subjectAltNames “host1,host2”]
\n.\/zmcertmgr createcrt [-new] [-days validation days] [-keysize 1024] [-subject subject] [-subjectAltNames “host1,host2”]
\n.\/zmcertmgr deploycrt <self>
\n.\/zmcertmgr deploycrt <comm> [certfile] [ca_chain_file]
\n.\/zmcertmgr savecrt
\n.\/zmcertmgr viewcsr <self|comm> [csr_file]
\n.\/zmcertmgr viewdeployedcrt [all|ldap|mta|proxy|mailboxd]
\n.\/zmcertmgr viewstagedcrt <self|comm> [certfile]
\n.\/zmcertmgr verifycrt <self|comm> [priv_key] [certfile]
\n.\/zmcertmgr verifycrtchain <ca_file> <certfile>
\n.\/zmcertmgr checkcrtexpiration [-days 30] [service]
\n.\/zmcertmgr addcacert <certfile>
\n.\/zmcertmgr migrate<\/p>\n
Comments:
\n– Default <certfile>
\nself-signed \/opt\/zimbra\/ssl\/zimbra\/server\/server.crt
\ncommerical \/opt\/zimbra\/ssl\/zimbra\/commercial\/commercial.crt
\n– Default <priv_key>
\nself-signed \/opt\/zimbra\/ssl\/zimbra\/server\/server.key
\ncommercial \/opt\/zimbra\/ssl\/zimbra\/commercial\/commercial.key
\n– Default <subject>
\n“\/C=US\/ST=N\\\/A\/L=N\\\/A\/O=Zimbra Collaboration Suite\/OU=Zimbra Collaboration Suite\/CN=mail.ucsc.cmb.ac.lk”
\n– Default RSA <keysize> is 1024.
\n– Default <validation_days> is 365.
\n– Default <csr_file> is
\n– deploycrt self installs the certificates using self signed csr in \/opt\/zimbra\/ssl\/zimbra\/server
\n– deploycrt comm installs the certificates using commercially signed certificate in \/opt\/zimbra\/ssl\/zimbra\/commercial
\n– verifycrt <self|comm> compares openssl md5 [priv_key] and [certfile].
\n– migrate moves certs\/keys from ZCS installs prior to version 5.0.x
\n– addcacert appends an otherwise untrusted ssl certificate to the cacerts file.
\nThis is primarily for allowance of untrusted ssl certificates in external data sources.<\/p>\n","protected":false},"excerpt":{"rendered":"
Zimbra Creating self-signed certifiate UCSC Zimbra ===========<\/p>\n
Backup Existing Commertical Certs ———————————<\/p>\n
# cd \/opt\/zimbra\/ssl\/zimbra\/commercial\/ # mkdir -p DigiCert_old # cp commercial* .\/DigiCert_old<\/p>\n
# cd \/opt\/zimbra\/ssl\/zimbra\/server # mkdir -p Server_old # cp server.* Server_old<\/p>\n
# cd \/opt\/zimbra\/bin Creating a CA ————-<\/p>\n
# .\/zmcertmgr createca -new ** Creating \/opt\/zimbra\/ssl\/zimbra\/ca\/zmssl.cnf…done ** Creating CA private key \/opt\/zimbra\/ssl\/zimbra\/ca\/ca.key…done. ** […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[45],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3474"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3474"}],"version-history":[{"count":2,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3474\/revisions"}],"predecessor-version":[{"id":3476,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/3474\/revisions\/3476"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3474"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3474"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3474"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}