Certificate gets renewed but still shows expired in the site zimbra server

Help
1

Certificate gets renewed but still shows expired in the site zimbra server

My domain is: mail.ajnet.ec

I ran this command: sudo certbot renew --dry-run

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Processing /etc/letsencrypt/renewal/mail.ajnet.ec.conf

Simulating renewal of an existing certificate for mail.ajnet.ec

Congratulations, all simulated renewals succeeded:
/etc/letsencrypt/live/mail.ajnet.ec/fullchain.pem (success)

I ran this command: certbot certificates

It produced this output:

Found the following certs:
Certificate Name: mail.ajnet.ec
Serial Number: 429958f120bb186f8fc67f4b5bd93352042
Key Type: RSA
Domains: mail.ajnet.ec
Expiry Date: 2024-10-20 05:45:35+00:00 (VALID: 58 days)
Certificate Path: /etc/letsencrypt/live/mail.ajnet.ec/fullchain.pem
Private Key Path: /etc/letsencrypt/live/mail.ajnet.ec/privkey.pem

My web server is (include version): Zimbra 8.8.15

The operating system my web server runs on is (include version): Ubuntu server 20

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.11.0

2

Welcome @diegoalejrc

You need to review the steps you take to modify the certs from Certbot and deploy them to Zimbra. Your server is actually using a cert you got on Jan23. Yet, you have gotten fresh certs on Mar24, May23, and Jul22 but don't use any of those.

So, focus on changes to your system between Jan23 and Mar24. You may want to ask for help on a Zimbra forum

image
image2310×417 112 KB

3 Likes
3

Have a look at:

1 Like
4

I found this

Zimbra deployment

Create the following script that deploys the Let’s Encrypt certificate
on Zimbra:

cat >> /usr/local/sbin/letsencrypt-zimbra << EOF #!/bin/bash /usr/local/sbin/certbot certonly -d $(hostname --fqdn) --standalone -n --preferred-chain "ISRG Root X1" --agree-tos --register-unsafely-without-email cp "/etc/letsencrypt/live/$(hostname --fqdn)/privkey.pem" /opt/zimbra/ssl/zimbra/commercial/commercial.key chown zimbra:zimbra /opt/zimbra/ssl/zimbra/commercial/commercial.key wget -O /tmp/ISRG-X1.pem https://letsencrypt.org/certs/isrgrootx1.pem.txt rm -f "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem" cp "/etc/letsencrypt/live/$(hostname --fqdn)/chain.pem" "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem" cat /tmp/ISRG-X1.pem >> "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem" chown zimbra:zimbra /etc/letsencrypt -R cd /tmp su zimbra -c '/opt/zimbra/bin/zmcertmgr deploycrt comm "/etc/letsencrypt/live/$(hostname --fqdn)/cert.pem" "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem"' rm -f "/etc/letsencrypt/live/$(hostname --fqdn)/chainZimbra.pem" EOF

Set the correct permission, set up a cron job and run the deployment:

chmod +rx /usr/local/sbin/letsencrypt-zimbra ln -s /usr/local/sbin/letsencrypt-zimbra /etc/cron.daily/letsencrypt-zimbra /etc/cron.daily/letsencrypt-zimbra

Finally restart Zimbra to load the new certificate:

sudo su zimbra -c '/opt/zimbra/bin/zmcontrol restart'

But, in what directory i should create the script?

5

Based on how I read it [although it wraps where it shouldn't]...
I think this is the example location and name:

1 Like
6

That cat ... EOF (second EOF at the end) is a single command to put the script into the file /usr/local/sbin/letsencrypt-zimbra. This is simply basic Linux/*nix terminal stuff. If you don't understand this, maybe you shouldn't be using these kind of instructions. At least not until you understand what the commands do.

1 Like
7

I use the commad
/etc/cron.daily/letsencrypt-zimbra
And the output is:
/etc/cron.daily/letsencrypt-zimbra: line 16: /usr/local/sbin/certbot: No such file or directory
--2024-08-22 20:10:18-- https://letsencrypt.org/certs/isrg-root-x2.pem
Resolving letsencrypt.org (letsencrypt.org)... 44.217.161.11, 44.219.53.183, 2600:1f18:2489:8201::c8, ...
Connecting to letsencrypt.org (letsencrypt.org)|44.217.161.11|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 790 [application/x-pem-file]
Saving to: ‘/tmp/ISRG-X2.pem’

/tmp/ISRG-X2.pem 100%[=========================================================>] 790 --.-KB/s in 0s

2024-08-22 20:10:19 (50.2 MB/s) - ‘/tmp/ISRG-X2.pem’ saved [790/790]

** Verifying '/etc/letsencrypt/live/mail.ajnet.ec/cert.pem' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
Certificate '/etc/letsencrypt/live/mail.ajnet.ec/cert.pem' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.
** Verifying '/etc/letsencrypt/live/mail.ajnet.ec/cert.pem' against '/etc/letsencrypt/live/mail.ajnet.ec/chainZimbra.pem'
ERROR: Unable to validate certificate chain: C = US, O = Let's Encrypt, CN = R11
error 2 at 1 depth lookup: unable to get issuer certificate
error /etc/letsencrypt/live/mail.ajnet.ec/cert.pem: verification failed
/etc/cron.daily/letsencrypt-zimbra: line 28: /usr/local/sbin/certbot: No such file or directory
--2024-08-22 20:10:20-- https://letsencrypt.org/certs/isrg-root-x2.pem
Resolving letsencrypt.org (letsencrypt.org)... 44.219.53.183, 44.217.161.11, 2600:1f18:2489:8202::c8, ...
Connecting to letsencrypt.org (letsencrypt.org)|44.219.53.183|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 790 [application/x-pem-file]
Saving to: ‘/tmp/ISRG-X2.pem’

8

It looks like you followed instructions for current versions of Zimbra. But, yours is older and does not support ECDSA certs.

Your instructions are here:
https://wiki.zimbra.com/index.php?title=Installing_a_LetsEncrypt_SSL_Certificate&oldid=69351

Note also this from the current Zimbra docs linked by @rg305 earlier

Support for ECDSA TLS (elliptic curve cryptography ECC) certificates has been added to Zimbra zmcertmgr from Zimbra versions 10.0.6, Joule-8.8.15-Patch-45, Kepler-9.0.0-Patch-38. Let’s Encrypt Certbot defaults to ECDSA secp256r1 (P-256) since version 2.0.0. If you are running out-of-date versions of the software or have another reason why you are required to use RSA certificates. Refer to Installing a LetsEncrypt SSL Certificate - Zimbra :: Tech Center at your own risk as we do not support/test or update documentation for out of date deployments.

3 Likes
9

Yes, thats the solution. I deploy the cert and that work.

Thank you for your help :smiley:

2 Likes