Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com ), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
I ran this command: /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
It produced this output: ERROR: Unable to validate certificate chain: cert.pem: C = US, O = Internet Security Research Group, CN = ISRG Root X1
My web server is (include version): Zimbra 8.8.15
The operating system my web server runs on is (include version):
I can login to a root shell on my machine (yes or no, or I don't know):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.11.0
It looks like Zimbra has a custom step they’d like you to do:
https://wiki.zimbra.com/wiki/Installing_a_LetsEncrypt_SSL_Certificate
The commands here about fetching the X1 root and appending it to the chain might be required. I’m not sure what they’re doing to require that though.
10 Likes
when I run the commandhttps://letsencrypt.org/certs/isrgrootx1.pem.txt ,letsencrypt.org 's certificate, issued by '/C=US /O=Let's Encrypt/CN=R3':letsencrypt.org insecurely, use `--no-check-certificate'. , what should I do?
rg305
June 30, 2022, 3:16am
4
Check the date/time on your server.
7 Likes
I have checked and everything is correct
[root@mail ~]# timedatectl status
it worked, but still error like this
/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /etc/letsencrypt/live/mail12.com/cert.pem /etc/letsencrypt/live/mail12.com/chain.pem
** Verifying '/etc/letsencrypt/live/mail12.com/cert.pem' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
rg305
June 30, 2022, 7:45am
8
Show:
trust dump --filter="pkcs11:id=%79%b4%59%e6%7b%b6%e5%e4%01%73%80%08%88%c8%1a%58%f6%e9%9b%6e;type=cert"
If nothing is shown, try:update-ca-trust
8 Likes
Osiris
June 30, 2022, 7:50am
9
I suppose your wget is linked to an older version of OpenSSL, probably 1.0.2. You should try to upgrade your software so it uses OpenSSL 1.1.1.
8 Likes
[root@mail ~]# trust dump --filter="pkcs11:id=%79%b4%59%e6%7b%b6%e5%e4%01%73%80%08%88%c8%1a%58%f6%e9%9b%6e;type=cert"
# pkcs11:id=%79%b4%59%e6%7b%b6%e5%e4%01%73%80%08%88%c8%1a%58%f6%e9%9b%6e;type=cert
[p11-kit-object-v1]
private: false
label: "ISRG Root X1"
issuer: "0O1%0b0%09%06%03U%04%06%13%02US1%290%27%06%03U%04%0a%13 Internet Security Research Group1%150%13%06%03U%04%03%13%0cISRG Root X1"
serial-number: "%02%11%00%82%10%cf%b0%d2%40%e3YDc%e0%bbc%82%8b%00"
trusted: true
certificate-category: authority
java-midp-security-domain: 0
url: ""
hash-of-subject-public-key: "%f8%16Q%3c%fd%1bD%9f.k%28%a1%97%22%1f%b8%1fQN%3c"
hash-of-issuer-public-key: ""
check-value: "%ca%bd%2a"
subject: "0O1%0b0%09%06%03U%04%06%13%02US1%290%27%06%03U%04%0a%13 Internet Security Research Group1%150%13%06%03U%04%03%13%0cISRG Root X1"
id: "y%b4Y%e6%7b%b6%e5%e4%01s%80%08%88%c8%1aX%f6%e9%9bn"
start-date: "20150604"
end-date: "20350604"
modifiable: false
nss-mozilla-ca-policy: true
x-distrusted: false
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
after update what should i do?
rg305
June 30, 2022, 8:23am
13
That is the correct certificate.yum list updates
7 Likes
[root@mail ~]# yum list updates
base: mirror.idroot.cloud
epel: linux.domainesia.com
extras: mirror.idroot.cloud
updates: mirror.idroot.cloud
is there something wrong?
Osiris
June 30, 2022, 8:29am
16
Hm, it seems CentOS 7 is in "Maintenance Updates2 " only, which probably means there won't be an (official) OpenSSL 1.1.1. for it. There are alternatives for using OpenSSL 1.0.2 and servers serving the Let's Encrypt "long chain" here: Old Let's Encrypt Root Certificate Expiration and OpenSSL 1.0.2 - OpenSSL Blog
Looks like there are many packages to be updated. It's adviced to update regularly to get the latest security updates.
7 Likes
rg305
June 30, 2022, 8:31am
17
Updating [all of] Zimbra might overcome that problem .
8 Likes
does that mean I have to upgrade my zimbra version? to what version?
rg305
June 30, 2022, 8:34am
19
Slight understatement (if that's possible)...ever been updated?
7 Likes
is it safe to update? the data?
rg305
June 30, 2022, 8:35am
21
Those are questions better asked on their support channel(s).
7 Likes
means there is no other way but to update the zimbra system?