Unable to renew my LetsEncrypt Certificate for Zimbra

DWD · November 22, 2021, 11:14am

Hello,
I have zimbra & letsencrypt since more than 5 years and have never meet any problem but today, I'm unable to apply the new certificat to my Zimbra server.

I launch:
/opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem

And obtain:
** Verifying 'cert.pem' against 'privkey.pem'
Certificate 'cert.pem' and private key 'privkey.pem' match.
** Verifying 'cert.pem' against 'chain.pem'
ERROR: Unable to validate certificate chain: O = Digital Signature Trust Co., CN = DST Root CA X3
error 10 at 3 depth lookup: certificate has expired
error cert.pem: verification failed

I always followed the documentation of Zimbra which are the same than ubuntu, here (and also some script from mysel and found on internet - with the same result):
https://wiki.zimbra.com/wiki/Installing_a_LetsEncrypt_SSL_Certificate

I read a lot of quantity of article, try some 10e of solution proposed but I think that my problem come from of the new letsencrypt architecture with the ISRG Root X1 for the chain. So my question and how generate that ? I couldn't find the option --preferred-chain on letsencrypt or certbot

Could you please help me ?

rg305 · November 22, 2021, 5:45pm

HI @DWD and welcome to the LE community forum

Which ACME client are you using?
What OS and version are you using?
What version of OpenSSL are you using?

Sorry that I don't have any answers for you (yet).

DWD · November 22, 2021, 6:40pm

Hi @rg305 and thank you for your answer.
I use Ubuntu 18.04.6 LTS
I use OpenSSL 1.1.1 11 Sep 2018
And about LetsEncrypt, it's certbot 0.27.0

rg305 · November 22, 2021, 9:09pm

Step #1: Update certbot
See: https://certbot.eff.org/
[which may allow you to use the --preferred-chain parameter]

DWD · November 23, 2021, 9:03am

Hello @rg305 and thank new about this new answer.
I'm successfully upgrade certbot to the last version (1.21).
I restart my setup with generate new certificate:

certbot --force-renewal --preferred-chain "ISRG Root X1" -d mx.domain.eu

But after when I try to setup this, I obtain the following ERROR:

zimbra@mx:~/ssl/letsencrypt$ /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
** Verifying 'cert.pem' against 'privkey.pem'
Certificate 'cert.pem' and private key 'privkey.pem' match.
** Verifying 'cert.pem' against 'chain.pem'
ERROR: Unable to validate certificate chain: C = US, O = Let's Encrypt, CN = R3
error 2 at 1 depth lookup: unable to get issuer certificate
error cert.pem: verification failed

I continue to search but if somebody have an idea, it's welcome

Thanks. Regards

rg305 · November 23, 2021, 2:00pm

I'm unable to reach your site to verify the chain file.
Please show the chain.pem file.
and the output of this folder:
ls -ltr ~/ssl/letsencrypt

DWD · November 24, 2021, 8:26am

Sure, this is my chain.pem file:

It has been generated successfully with command:

certbot --force-renewal --preferred-chain "ISRG Root X1" -d mx.inkmail.eu

And the content of my ssl/letsencrypt folder on Zimbra

zimbra@mx:~/ssl/letsencrypt$ ls -ltr ~/ssl/letsencrypt
total 20
drwxr-xr-x 2 zimbra zimbra 4096 Dec 16  2019 old
-rw-r----- 1 zimbra zimbra 1704 Nov 23 09:56 privkey.pem
-rw-r----- 1 zimbra zimbra 3664 Nov 23 09:56 fullchain.pem
-rw-r----- 1 zimbra zimbra 1838 Nov 23 09:56 cert.pem
-rw-r----- 1 zimbra zimbra 3026 Nov 23 09:56 chain.pem

rg305 · November 24, 2021, 8:43am

Your chain shown is:

Which is incorrect/incomplete.
It is missing the connection between "R3" and "DST Root CA X3".
[where is the "ISRG Root X1" cert?]

Please show:
cat ~/ssl/letsencrypt/chain.pem

DWD · November 24, 2021, 12:01pm

It's always my chain file. The first part is the chain.pem generated with my command and the second the zimbra commercial chain which I should to add (it's maybe this is who is expired)

DWD · November 24, 2021, 12:05pm

Ok I understood, it's the second part of my chain who is expired
So I re-read the Zimbra documentation about letsencrypt and replace this second part of the chain (than I recopy each 3 month from Zimbra installation's) by : https://letsencrypt.org/certs/isrgrootx1.pem.txt

Now it seems to be OK. A big thanks to you for your help, I love you

system · December 24, 2021, 12:05pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Cannot renew my certificate on Zimbra Help	2	1980	December 30, 2021
Can somebody help me to solve the issue with Letsencrypt certificate for Zimbra? Help	28	5862	February 24, 2022
Zimbra - LetsEncprypt Help	30	1702	December 20, 2021
Issue with certificate renewal Help	48	3957	October 6, 2021
Renew certificate - ZIMBRA Help	20	6498	January 14, 2021

Unable to renew my LetsEncrypt Certificate for Zimbra

Related topics