Linux

Installing a Gandi Certificate on Zimbra

March 23, 2016

3 min read

Installing a commercial certificate on Zimbra is very simple. Strengthen the security of your Zimbra services with a Gandi certificate.

Certified in

Table of contents

Real-world use case
Installing a Gandi certificate on Zimbra
Creating the commercial certificate on Zimbra
Conclusion

Real-world use case

You need to secure webmail access to your Zimbra server: here's how to easily install a Gandi commercial certificate.

Installing a Gandi certificate on Zimbra

An SSL certificate validated by a certificate authority is essential, especially to guarantee a sufficient level of trust to your users. For a Zimbra server accessible over https on the front end, we'll use a commercial certificate provided by Gandi. Setup is very quick and very simple.

Info: The Zimbra server already has a self-signed certificate, so we'll replace it with Gandi's.

Creating the commercial certificate on Zimbra

To start, we'll need the following certificates:

Gandi's commercial certificate: certificate-205432.crt.
Gandi's SHA2 intermediate certificate: GandiStandardSSLCA2.pem.
The authority's root certificate: addtrustexternalcaroot.crt.

Once we have all the certificates, let's go to:

bash

cd /opt/zimbra/ssl/zimbra/commercial/

Let's create our first commercial.crt certificate for Zimbra (paste in the content of your Gandi certificate: certificate-205432.crt).

bash

nano commercial.crt

Then we'll now create a second file:

bash

touch commercial_ca.crt

Here, in order: the GandiStandardSSLCA2.pem certificate, then the addtrustexternalcaroot.crt certificate, like this:

bash

We've now done the hardest part, our two certificates are in place:

bash

commercial_ca.crt  commercial.crt

The next step validates our certificate:

bash

/opt/zimbra/openssl/bin/openssl verify -CAfile commercial_ca.crt commercial.crt

The result should look like this:

bash

commercial.crt
commercial.crt: OK

Then deployment is done like this:

bash

/opt/zimbra/bin/zmcertmgr deploycrt comm commercial.crt commercial_ca.crt

The result then appears:

yaml

Valid Certificate: commercial.crt: OK
** Copying commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
cp: 'commercial.crt' and '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' are the same file
** Appending ca chain commercial_ca.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
cp: 'commercial_ca.crt' and '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' are the same file
** Importing certificate /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt to CACERTS as zcs-user-commercial_ca...done.
** NOTE: mailboxd must be restarted in order to use the imported certificate.
** Saving server config key zimbraSSLCertificate...done.
** Saving server config key zimbraSSLPrivateKey...done.
** Installing mta certificate and key...done.
** Installing slapd certificate and key...done.
** Installing proxy certificate and key...done.
** Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12...done.
** Creating keystore file /opt/zimbra/mailboxd/etc/keystore...done.
** Installing CA to /opt/zimbra/conf/ca...done.

Once in place, let's restart our server:

bash

zmcontrol restart

The "openssl" command can also be used to check our certificate's validity by emulating a client:

bash

openssl s_client -showcerts -connect your_zimbra_server:465

Your certificate is working.

Conclusion

Previous articleIntroduction to Containers Next article VMware vCenter: Distributed vSwitch

Back to blog