Using these links as a starting place,
http://www.jransomed.com/mywiki/Zimbra/InstallingSSLCertificate
http://wiki.zimbra.com/index.php?title=5.x_Commercial_Certificates_Guide
Here’s a run-down of installing SSL certificates in Zimbra Collaboration Suite (ZCS) 5.0.x. It’s relatively straightforward once you wrap your head around the steps. You’ll want to do these steps as root.
The customer on which this example is based had existing Comodo wildcard certificates for their *.domain.edu.
Browse to http://instantssl.com
log in
Arrow over to Comodo PreimumSSL Wildcard Certificate for *.domain.edu
click on ‘Download as .zip’
You should have three files that start with ‘STAR.’ rename them:
STAR_domain_edu.crt to commercial.crt
STAR_domain_edu.crt to commercial_ca.crt
STAR_domain_edu.key to commercial.key
Copy the commercial* files to each of the Zimbra hosts.
# mv commercial.key /opt/zimbra/ssl/zimbra/commercial
# mv commercial.crt commercial_ca.crt /var/tmp
Deploy the cert:
# cd /var/tmp
# zmcertmgr deploycrt comm ./commercial.crt commercial_ca.crt
This may not apply to you but we were unable to get openssl and by extension Zimbra to verify the Comodo cert chain. If zmcertmgr deploycrt is failing for you and you’re relatively confident your certs are okay here’s how I fixed it. It’s unconventional but it works. I am open to correction if someone has a more conventional fix for this..
Cd to /opt/zimbra/bin, copy zmshutil and zmcertmgr to /var/tmp and edit zmcertmgr in /var/tmp. Comment out the lines as below and add two lines also as below:
# cd /opt/zimbra/bin
# cp zmshutil /var/tmp/zmshutil
# cp zmcertmgr /var/tmp/zmcertmgr
# vi /var/tmp/zmcertmgr
# result=`${openssl} verify -purpose sslserver -CAfile $ca_crt $crt`
# if [ x"${result}" = x"${crt}: OK" ]; then
# echo "Valid Certificate: $result"
echo "(artificially) Valid Certificate: $result"
# else
# echo "${ERROR_PREFIX} Invalid Certificate: $result"
# exit 1
# fi
# result=`${openssl} verify -purpose sslserver -CAfile $cafile $crt`
# if [ x"${result}" = x"${crt}: OK" ]; then
# echo "Valid Certificate Chain: $result"
echo "(artificially) Valid Certificate Chain: $result"
# else
# echo "${ERROR_PREFIX} Invalid Certificate Chain: $result"
# exit 1
# fi
Once you’ve saved the modified version of zmcertmgr, run it from /var/tmp to deploy the certificates:
# cd /var/tmp
# ./zmcertmgr deploycrt comm ./commercial.crt commercial_ca.crt
** Verifying ./commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (./commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
(artificially) Valid Certificate:
** Copying ./commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
** Appending ca chain commercial_ca.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
** Saving server config key zimbraSSLCertificate...done.
** Saving server config key zimbraSSLPrivateKey...done.
** Installing mta certificate and key...done.
** Installing slapd certificate and key...done.
** Installing proxy certificate and key...done.
** Installing CA to /opt/zimbra/conf/ca...done.
Now your certificates are installed. You need to restart Zimbra for them to take effect:
# su - zimbra -c "zmcontrol stop && zmcontrol start"
You’ll need to repeat the above for each of your servers if you have a multi-server environment: stores, mtas, ldap, etc.
If you have a relatively recent version of openssl you can test that your certificate is working by testing tls on your mta(s):
$ openssl s_client -starttls smtp -connect mta.domain.edu:25