I recently requested an update to our LetsEncrypt certificates to change the key_type to ecdsa using elliptical-curve secp384r1 which are seen as more secure these days – the certs were generated fine but as soon as I tried to deploy them in zimbra the process failed as zmcertmgr was unable to verify the public key matched the cert.
[root@mail tmp]# su - zimbra -c "/opt/zimbra/bin/zmcertmgr verifycrt comm /tmp/privkey1.pem /tmp/cert16.pem /tmp/zimbra_chain1.pem" ** Verifying '/tmp/cert1.pem' against '/tmp/privkey1.pem' 139741916038976:error:0607907F:digital envelope routines:EVP_PKEY_get0_RSA:expecting an rsa key:crypto/evp/p_lib.c:469: ERROR: Certificate '/tmp/cert1.pem' and private key '/tmp/privkey1.pem' do not match.
To make sure I did not have a broken system, I force renewed my certificate again changing the key_type back to rsa. This time the certs validated and deployed.
to fix this issue run these script:
#!/bin/sh # zmcertmgr=/opt/zimbra/bin/zmcertmgr cp $zmcertmgr $zmcertmgr.bak sed -i -e 's/$self->run("$ssl rsa -noout -modulus -in '$keyf'/$self->run("$ssl pkey -pubout -in '$keyf'/g' -e 's/$self->run("$ssl x509 -noout -modulus -in '$crtf'/$self->run("$ssl x509 -noout -pubkey -in '$crtf'/g' $zmcertmgr
With the change in place the certificates verify correctly.
[root@mail tmp]# su - zimbra -c "/opt/zimbra/bin/zmcertmgr verifycrt comm /tmp/privkey1.pem /tmp/cert1.pem /tmp/zimbra_chain1.pem" ** Verifying '/tmp/cert1.pem' against '/tmp/privkey1.pem' Certificate '/tmp/cert1.pem' and private key '/tmp/privkey1.pem' match. ** Verifying '/tmp/cert1.pem' against '/tmp/zimbra_chain1.pem' Valid certificate chain: /tmp/cert16.pem: OK
Further, the following error is possible: ldap-daemon does not start
Quick fix:
zmlocalconfig -e ldap_starttls_required=false zmlocalconfig -e ldap_starttls_supported=0
Similar Posts:
- Howto Renew Zimbra Letsencrypt SSL certificate
- Renew Let’sencrypt certificate on Carbonio CE
- How to get Let’s Encrypt wildcard certificate using acme.sh
- How to free up disk space on Zimbra server
- Zimbra reports “ Error: Queue report unavailable – mail system is down ”
1,188
Hi,
How to used this script?
could you help me, please?
Thanks, I managed to solve by creating the script and then running the script. Everything’s fine.
np 😛
Thanks. It’s working for me.
Thanks. It’s working for me.