Problem validating cert on Zimbra

jppo · September 21, 2023, 2:08pm

Je peux lire des réponses en Anglais :

Mon nom de domaine est : mail.jppozzi.dyndns.org
J’ai exécuté ces commandes :

executed as "root"

------------------

certbot certonly --key-type rsa --standalone
certbot --version
certbot 2.6.0

The result was "clean"

cd /etc/letscencrypt/live/mail.jppozzi.dyndns.org
cp *.pem /opt/zimbra/ssl/letsencrypt

cp privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
chown zimbra: /opt/zimbra/ssl/zimbra/commercial/*
chown zimbra: /opt/zimbra/ssl/letsencrypt/*

executed as user "zimbra"

-------------------------

cd /opt/zimbra/ssl/letsencrypt
cat ISRG-X1.pem >>./chain.pem

cp cert.pem /opt/zimbra/ssl/zimbra/commercial/commercial.crt
cp chain.pem /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt

When I try to verify the cert with zimbra

COMM=/opt/zimbra/ssl/zimbra/commercial/commercial.key
CERT=/opt/zimbra/ssl/letsencrypt/cert.pem
CHAIN=/opt/zimbra/ssl/letsencrypt/chain.pem
export COMM CERT CHAIN

/opt/zimbra/bin/zmcertmgr verifycrt comm ${COMM} ${CERT} ${CHAIN}
I get following results :
** Verifying '/opt/zimbra/ssl/letsencrypt/cert.pem' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
Certificate '/opt/zimbra/ssl/letsencrypt/cert.pem' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.
** Verifying '/opt/zimbra/ssl/letsencrypt/cert.pem' against '/opt/zimbra/ssl/letsencrypt/chain.pem'
ERROR: Unable to validate certificate chain: C = US, O = Internet Security Research Group, CN = ISRG Root X1
error 2 at 2 depth lookup: unable to get issuer certificate
error /opt/zimbra/ssl/letsencrypt/cert.pem: verification failed

Le système d’exploitation sur lequel mon serveur Web s’exécute est (version incluse) : ubuntu 20.04

Je peux me connecter à un shell root sur ma machine (oui ou non, ou je ne sais pas) : OUI

J’utilise un panneau de configuration pour gérer mon site (non, ou fournit le nom et la version du panneau de configuration) : NON

Bruce5051 · September 21, 2023, 3:08pm

Your Certificate is being signed by R3, is that in your chain?

Please share the contents of

From here Chain of Trust - Let's Encrypt

rg305 · September 22, 2023, 3:24am

I use a file with:

How does that compare to your file?

jppo · September 22, 2023, 10:17am

Hello,

Thanks for the answer, I compare the file with mine and there are many differences.
The first cert is OK, but the second part is completely other.
I didn't understand why ?

Regards

JP P

jppo · September 22, 2023, 11:50am

Hello,

I didn't know how to get the R3 cert and to put it in the chain.

Thanks for the answer.

JP P

rg305 · September 22, 2023, 10:09pm

Did the certs I gave you work for you?

jppo · September 29, 2023, 2:46pm

Hello,

I apologize for the late answer but I go one week in holydays ....
I try with the second certificate and ... it works.
What was the problem getting the certs with "certbot" ?

Regards

JP P

rg305 · September 29, 2023, 3:03pm

I'm not sure what the problem was.
Did you use the certs I gave you?
OR what else may have changed?

jppo · September 29, 2023, 3:18pm

Hello,

I use the second cert in your mail to replace the second cert in my
"chain.pem"
without any other action.

Regards

JP P

rg305 · September 29, 2023, 3:19pm

That must have been the change that made it work.

rg305 · September 29, 2023, 3:21pm

I don't think you actually had any probelm getting certs with certbot.
The problem was how Zimbra uses certs - very non-standard:
It requires the complete chain [including the root cert] before it can validate and use it.
And you were using the wrong root cert.

system · October 29, 2023, 3:22pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.