Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com ), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
I ran this command: /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
It produced this output: ERROR: Unable to validate certificate chain: cert.pem: C = US, O = Internet Security Research Group, CN = ISRG Root X1
My web server is (include version): Zimbra 8.8.15
The operating system my web server runs on is (include version):
I can login to a root shell on my machine (yes or no, or I don't know):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.11.0
It looks like Zimbra has a custom step they’d like you to do:
https://wiki.zimbra.com/wiki/Installing_a_LetsEncrypt_SSL_Certificate
The commands here about fetching the X1 root and appending it to the chain might be required. I’m not sure what they’re doing to require that though.
when I run the commandhttps://letsencrypt.org/certs/isrgrootx1.pem.txt ,letsencrypt.org 's certificate, issued by '/C=US /O=Let's Encrypt/CN=R3':letsencrypt.org insecurely, use `--no-check-certificate'. , what should I do?
rg305
June 30, 2022, 3:16am
4
Check the date/time on your server.
I have checked and everything is correct
[root@mail ~]# timedatectl status
it worked, but still error like this
/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /etc/letsencrypt/live/mail12.com/cert.pem /etc/letsencrypt/live/mail12.com/chain.pem
** Verifying '/etc/letsencrypt/live/mail12.com/cert.pem' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
rg305
June 30, 2022, 7:45am
8
Show:
trust dump --filter="pkcs11:id=%79%b4%59%e6%7b%b6%e5%e4%01%73%80%08%88%c8%1a%58%f6%e9%9b%6e;type=cert"
If nothing is shown, try:update-ca-trust
Osiris
June 30, 2022, 7:50am
9
I suppose your wget is linked to an older version of OpenSSL, probably 1.0.2. You should try to upgrade your software so it uses OpenSSL 1.1.1.
[root@mail ~]# trust dump --filter="pkcs11:id=%79%b4%59%e6%7b%b6%e5%e4%01%73%80%08%88%c8%1a%58%f6%e9%9b%6e;type=cert"
# pkcs11:id=%79%b4%59%e6%7b%b6%e5%e4%01%73%80%08%88%c8%1a%58%f6%e9%9b%6e;type=cert
[p11-kit-object-v1]
private: false
label: "ISRG Root X1"
issuer: "0O1%0b0%09%06%03U%04%06%13%02US1%290%27%06%03U%04%0a%13 Internet Security Research Group1%150%13%06%03U%04%03%13%0cISRG Root X1"
serial-number: "%02%11%00%82%10%cf%b0%d2%40%e3YDc%e0%bbc%82%8b%00"
trusted: true
certificate-category: authority
java-midp-security-domain: 0
url: ""
hash-of-subject-public-key: "%f8%16Q%3c%fd%1bD%9f.k%28%a1%97%22%1f%b8%1fQN%3c"
hash-of-issuer-public-key: ""
check-value: "%ca%bd%2a"
subject: "0O1%0b0%09%06%03U%04%06%13%02US1%290%27%06%03U%04%0a%13 Internet Security Research Group1%150%13%06%03U%04%03%13%0cISRG Root X1"
id: "y%b4Y%e6%7b%b6%e5%e4%01s%80%08%88%c8%1aX%f6%e9%9bn"
start-date: "20150604"
end-date: "20350604"
modifiable: false
nss-mozilla-ca-policy: true
x-distrusted: false
-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
after update what should i do?
rg305
June 30, 2022, 8:23am
13
That is the correct certificate.yum list updates
[root@mail ~]# yum list updates
base: mirror.idroot.cloud
epel: linux.domainesia.com
extras: mirror.idroot.cloud
updates: mirror.idroot.cloud
is there something wrong?
Osiris
June 30, 2022, 8:29am
16
Hm, it seems CentOS 7 is in "Maintenance Updates2 " only, which probably means there won't be an (official) OpenSSL 1.1.1. for it. There are alternatives for using OpenSSL 1.0.2 and servers serving the Let's Encrypt "long chain" here: Old Let's Encrypt Root Certificate Expiration and OpenSSL 1.0.2 - OpenSSL Blog
Looks like there are many packages to be updated. It's adviced to update regularly to get the latest security updates.
rg305
June 30, 2022, 8:31am
17
Updating [all of] Zimbra might overcome that problem .
does that mean I have to upgrade my zimbra version? to what version?
rg305
June 30, 2022, 8:34am
19
Slight understatement (if that's possible)...ever been updated?
is it safe to update? the data?
rg305
June 30, 2022, 8:35am
21
Those are questions better asked on their support channel(s).
means there is no other way but to update the zimbra system?