# Problem validating cert on Zimbra **URL:** \ **Category:** Aide (en français)\ **Created:** [September 21, 2023, 2:08pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516 "2023-09-21T14:08:28Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![jppo](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jppo/32/56620_2.png) [@jppo](https://community.letsencrypt.org/u/jppo)\ **Post date:** [September 21, 2023, 2:08pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/1 "2023-09-21T14:08:28Z")
Je peux lire des réponses en Anglais : Mon nom de domaine est : [mail.jppozzi.dyndns.org](http://mail.jppozzi.dyndns.org) J’ai exécuté ces commandes : # # executed as "root" # ------------------ certbot certonly --key-type rsa --standalone certbot --version certbot 2.6.0 # The result was "clean" cd /etc/letscencrypt/live/mail.jppozzi.dyndns.org cp \*.pem /opt/zimbra/ssl/letsencrypt cp privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key chown zimbra: /opt/zimbra/ssl/zimbra/commercial/\* chown zimbra: /opt/zimbra/ssl/letsencrypt/\* # # executed as user "zimbra" # ------------------------- cd /opt/zimbra/ssl/letsencrypt cat ISRG-X1.pem \>\>./chain.pem # cp cert.pem /opt/zimbra/ssl/zimbra/commercial/commercial.crt cp chain.pem /opt/zimbra/ssl/zimbra/commercial/commercial\_ca.crt ## ## When I try to verify the cert with zimbra COMM=/opt/zimbra/ssl/zimbra/commercial/commercial.key CERT=/opt/zimbra/ssl/letsencrypt/cert.pem CHAIN=/opt/zimbra/ssl/letsencrypt/chain.pem export COMM CERT CHAIN /opt/zimbra/bin/zmcertmgr verifycrt comm ${COMM} ${CERT} ${CHAIN} I get following results : \*\* Verifying '/opt/zimbra/ssl/letsencrypt/cert.pem' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key' Certificate '/opt/zimbra/ssl/letsencrypt/cert.pem' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match. \*\* Verifying '/opt/zimbra/ssl/letsencrypt/cert.pem' against '/opt/zimbra/ssl/letsencrypt/chain.pem' ERROR: Unable to validate certificate chain: C = US, O = Internet Security Research Group, CN = ISRG Root X1 error 2 at 2 depth lookup: unable to get issuer certificate error /opt/zimbra/ssl/letsencrypt/cert.pem: verification failed Le système d’exploitation sur lequel mon serveur Web s’exécute est (version incluse) : ubuntu 20.04 Je peux me connecter à un shell root sur ma machine (oui ou non, ou je ne sais pas) : OUI J’utilise un panneau de configuration pour gérer mon site (non, ou fournit le nom et la version du panneau de configuration) : NON ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [September 21, 2023, 3:08pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/2 "2023-09-21T15:08:54Z")
> [@jppo](#): > > \*\* Verifying '/opt/zimbra/ssl/letsencrypt/cert.pem' against '/opt/zimbra/ssl/letsencrypt/chain.pem' > ERROR: Unable to validate certificate chain: C = US, O = Internet Security Research Group, CN = ISRG Root X1 > error 2 at 2 depth lookup: unable to get issuer certificate Your Certificate is being signed by **R3** , is that in your chain? Please share the contents of > [@jppo](#): > > /opt/zimbra/ssl/letsencrypt/chain.pem From here [Chain of Trust - Let's Encrypt](https://letsencrypt.org/certificates/) ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/3/9/3967461ee561b93fac6230fa3ed190fbfe970970.png) ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 22, 2023, 3:24am UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/3 "2023-09-22T03:24:30Z")
> [@jppo](#): > > cat ISRG-X1.pem \>\>./chain.pem I use a file with: ```nohighlight -----BEGIN CERTIFICATE----- MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG /kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4 avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2 yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+ HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX nLRbwHOoq7hHwg== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4 WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+ 0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ 3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5 ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq 4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc= -----END CERTIFICATE----- ``` How does that compare to your file? ---
**Author:** ![jppo](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jppo/32/56620_2.png) [@jppo](https://community.letsencrypt.org/u/jppo)\ **Post date:** [September 22, 2023, 10:17am UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/4 "2023-09-22T10:17:43Z")
Hello, Thanks for the answer, I compare the file with mine and there are many differences. The first cert is OK, but the second part is completely other. I didn't understand why ? Regards JP P ---
**Author:** ![jppo](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jppo/32/56620_2.png) [@jppo](https://community.letsencrypt.org/u/jppo)\ **Post date:** [September 22, 2023, 11:50am UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/5 "2023-09-22T11:50:36Z")
Hello, I didn't know how to get the R3 cert and to put it in the chain. Thanks for the answer. JP P ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 22, 2023, 10:09pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/6 "2023-09-22T22:09:11Z")
Did the certs I gave you work for you? ---
**Author:** ![jppo](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jppo/32/56620_2.png) [@jppo](https://community.letsencrypt.org/u/jppo)\ **Post date:** [September 29, 2023, 2:46pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/7 "2023-09-29T14:46:11Z")
Hello, I apologize for the late answer but I go one week in holydays .... I try with the second certificate and ... it works. What was the problem getting the certs with "certbot" ? Regards JP P ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 29, 2023, 3:03pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/8 "2023-09-29T15:03:37Z")
I'm not sure what the problem was. Did you use the certs I gave you? OR what else may have changed? ---
**Author:** ![jppo](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jppo/32/56620_2.png) [@jppo](https://community.letsencrypt.org/u/jppo)\ **Post date:** [September 29, 2023, 3:18pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/9 "2023-09-29T15:18:25Z")
Hello, I use the second cert in your mail to replace the second cert in my "chain.pem" without any other action. Regards JP P ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 29, 2023, 3:19pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/10 "2023-09-29T15:19:01Z")
That must have been the change that made it work. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 29, 2023, 3:21pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/11 "2023-09-29T15:21:30Z")
> [@jppo](#): > > What was the problem getting the certs with "certbot" ? I don't think you actually had any probelm getting certs with `certbot`. The problem was how `Zimbra` uses certs - very non-standard: It requires the complete chain [including the root cert] before it can validate and use it. And you were using the wrong root cert. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 29, 2023, 3:22pm UTC](https://community.letsencrypt.org/t/problem-validating-cert-on-zimbra/205516/12 "2023-10-29T15:22:29Z")
Closed on October 29, 2023, 3:22pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.