Unable to start TLS: SSL connect attempt failed error:14090086

Help
#1

Hi all,

Today I run the command "zmcontrol status" on my zimbra server, and I got the error:
Unable to start TLS: SSL connect attempt failed error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed when connecting to ldap master.
Cannot determine services - exiting
I check my server and everything seems normal: SSL certificate is valid, system date is correct, Mail server still works well.
But I get that error every time I run command check status (attach img).

Software: APACHE
System: Ubuntu 18.04

Can anyone help me please?
Thanks so much!

#2

Welcome to the forum @Abu
We can assist you much easire if we know about your setup..

My domain is:

I ran this command: zmcontrol status

It produced this output:

Unable to start TLS: SSL connect attempt failed error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed when connecting to ldap master.
Cannot determine services - exiting

Are you running OpenLDAP? if so which version?

My web server is (include version): APACHE (which version?)

The operating system my web server runs on is (include version): Ubuntu 18.04

My hosting provider, if applicable, is: ???

I can login to a root shell on my machine (yes or no, or I don’t know): ???

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): zmcontrol Zimbra Server

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

#3

Is all of Zimbra running on the same system - or is it split over multiple systems?
When was the last time you renewed the cert?

#4

My web server is (include version): Apache/2.4.29 (Ubuntu)

The operating system my web server runs on is (include version): Ubuntu 18.04

My hosting provider, if applicable, is: https://my.interserver.net/

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): yes, zmcontrol Zimbra Server

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): Installed: 0.31.0-2~deb10u1+ubuntu18.04.1+certbot+3

#5
  1. all of Zimbra running on the same system
  2. 26.11.2020
#6

First: Make sure your system is completely up to date.
sudo apt update
sudo apt upgrade

#7

all packages are up to date

#8

Change to Zimbra user and show the last commands ran (to cover installing the cert)
su zimbra
history

#9

1276 201230 21:06:37 zmcontrol status
1277 201230 21:15:48 zmlocalconfig -e ldap_starttls_required=true
1278 201230 21:16:04 zmlocalconfig -e ldap_starttls_supported=1
1279 201230 21:16:24 zmcontrol restart
1280 201230 21:23:03 exit
1281 201230 21:33:36 zmlocalconfig -e ldap_starttls_supported=0
1282 201230 21:33:48 zmcontrol start
1283 201230 22:12:55 exit
1284 201231 07:54:52 zmcontrol restart
1285 201231 08:05:00 jnvkjn oenfoverfv
1286 201231 08:06:21 zmcontrol status
1287 201231 08:06:42 exit
1288 210101 09:53:37 zmlocalconfig -e ldap_starttls_supported=1
1289 210101 09:53:47 zmcontrol status
1290 210101 09:54:22 zmlocalconfig -e ldap_starttls_supported=0
1291 210101 09:54:27 zmcontrol status
1292 210101 09:59:10 exit
1293 210101 10:32:09 zmcontrol stop
1294 210101 10:33:14 zmlocalconfig -e ldap_starttls_supported=1
1295 210101 10:33:18 exit
1296 210101 10:36:17 zmcontrol status
1297 210101 10:37:09 zmcontrol stop
1298 210101 10:37:21 exit
1299 210101 10:45:11 zmcontrol start
1300 210101 10:45:29 zmlocalconfig -e ldap_starttls_supported=0
1301 210101 10:45:45 zmcontrol restart
1302 210101 10:47:57 exit
1303 210101 10:51:12 zmcontrol stop
1304 210101 10:52:08 exit
1305 210101 09:18:57 zmcontrol restart
1306 210101 11:22:21 zmcontrol restart
1307 210101 11:25:12 zmlocalconfig -e ldap_starttls_supported=1
1308 210101 11:25:21 zmcontrol status
1309 210101 11:25:51 zmcontrol restart
1310 210101 11:26:53 zmlocalconfig -e ldap_starttls_supported=0
1311 210101 11:26:57 zmcontrol restart
1312 210102 05:33:53 zmlocalconfig -e ldap_starttls_supported=1
1313 210102 05:34:04 zmcontrol restart
1314 210102 05:39:06 exit
1315 210102 05:43:54 zmcontrol restart
1316 210102 05:44:26 zmlocalconfig -e ldap_starttls_supported=0
1317 210102 05:44:32 zmcontrol restart
1318 210102 05:46:36 exit
1319 210102 05:47:33 zmcontrol restart
1320 210102 05:52:25 exit
1321 210102 07:22:54 history

#10

Try:
su zimbra
history | grep -Ev 'exit|start|stop|ldap'

#11

1195 201102 07:57:58 postmap /opt/zimbra/conf/recipient_bcc
1199 201122 14:46:01 zimbra status
1200 201122 14:46:11 status
1201 201122 14:46:26 /zimbra status
1202 201122 14:46:37 zmcontrol status
1206 201124 07:04:58 zmcontrol status
1208 201126 07:09:26 zmcontrol status
1210 201126 07:18:53 zmcontrol status
1212 201126 07:32:48 zmcontrol status
1213 201128 10:52:22 certbot renew
1214 201128 10:52:48 sudo certbot renew
1215 201128 10:53:07 rgbvtr
1221 201128 11:16:21 zmcontrol status
1222 201130 07:13:01 zmcontrol status
1224 201207 09:02:43 zmcontrol status
1227 201207 09:34:13 zmcontrol status
1229 201207 09:40:31 postmap /opt/zimbra/conf/sender_bcc
1230 201207 09:40:41 postmap /opt/zimbra/conf/recipient_bcc
1232 201208 08:26:38 postmap /opt/zimbra/conf/sender_bcc
1233 201208 08:26:52 postmap /opt/zimbra/conf/recipient_bcc
1235 201209 11:37:28 zmprov gacf | grep zimbraMtaRestriction
1236 201210 10:48:00 postmap /opt/zimbra/conf/sender_bcc
1237 201210 10:48:10 postmap /opt/zimbra/confrecipient_bcc
1238 201210 10:48:20 postmap /opt/zimbra/conf/recipient_bcc
1240 201210 10:57:08 zmcontrol status
1242 201211 14:30:12 postmap /opt/zimbra/sender_bcc
1243 201211 14:30:25 postmap /opt/zimbra/conf/sender_bcc
1244 201211 14:30:36 postmap /opt/zimbra/conf/recipient_bcc
1246 201212 20:32:50 zmcontrol status
1249 201216 15:48:34 zmcontrol status
1250 201222 12:14:47 zmcontrol status
1251 201222 12:15:11 zmcontrol status
1257 201222 12:22:04 zmcontrol status
1259 201222 12:23:35 zmcontrol status
1265 201222 12:32:04 zmcontrol status
1266 201223 06:17:04 zmcontrol status
1267 201227 10:15:05 zmcontrol status
1269 201227 10:01:06 zmcontrol status
1272 201228 05:27:04 zmcontrol status
1274 201230 09:55:11 zmcontrol status
1276 201230 21:06:37 zmcontrol status
1285 201231 08:05:00 jnvkjn oenfoverfv
1286 201231 08:06:21 zmcontrol status
1289 210101 09:53:47 zmcontrol status
1291 210101 09:54:27 zmcontrol status
1296 210101 10:36:17 zmcontrol status
1308 210101 11:25:21 zmcontrol status
1321 210102 07:22:54 history

#12

Try:
su zimbra
history | grep -Ev 'exit|start|stop|ldap|status'

OR maybe the opposite...
su zimbra
history | grep -Ei 'zmcertmgr|comm|deploy|verify'

[maybe try that as root user too]

#13

872 200420 17:12:33 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem chain.pem cert.pem
873 200420 17:12:47 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
878 200420 17:19:33 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
885 200420 18:28:19 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
886 200420 18:28:53 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
888 200420 18:32:51 cp privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
889 200420 18:32:58 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
893 200420 18:39:28 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
912 200420 19:33:33 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
922 200420 23:03:22 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
924 200420 23:06:33 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
930 200420 23:08:34 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
932 200420 23:10:10 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
938 200420 23:13:30 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
943 200420 23:19:12 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
944 200420 23:20:29 cp privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
945 200420 23:21:27 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
951 200420 23:24:36 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
953 200420 23:25:53 cp privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
954 200420 23:26:07 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
959 200420 23:34:40 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
990 200515 14:19:25 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
996 200515 13:57:59 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey5.pem cert5.pem chain5.pem
1001 200515 14:01:19 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
1003 200515 14:02:16 cp privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
1004 200515 14:03:33 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
1013 200722 08:01:37 cp /var/backups/webSAYBKPS/mysql/mail.thesay.me/privkey19.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
1014 200722 08:02:03 cp privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
1015 200722 08:02:40 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
1016 200722 08:03:08 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
1020 200731 11:53:02 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
1022 200731 11:55:49 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
1024 200731 11:58:30 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1028 200731 12:12:31 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1040 200731 13:22:45 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
1042 200731 13:23:11 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1044 200731 13:24:20 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
1046 200731 13:41:10 cp privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
1047 200731 13:41:22 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
1050 200731 13:42:24 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
1053 200731 13:43:46 /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
1064 200731 13:56:40 cd common
1082 200731 14:06:02 /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
1085 200731 14:08:14 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1099 200731 14:19:05 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1108 200731 14:26:43 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1119 200731 18:22:46 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1129 200801 08:10:49 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1325 210102 07:42:22 history | grep -Ei 'zmcertmgr|comm|deploy|verify'

#14

Show:
su zimbra
history | grep -E '111|112|113'

#15

1113 200731 14:29:36 exit
1114 200731 16:06:23 zmprov md mail..ae zimbraVirtualHostName mx..ae zimbraVirtualIPAddress ...163
1115 200731 16:06:42 zmprov md .ae zimbraVirtualHostName mx..ae zimbraVirtualIPAddress ...163
1116 200731 16:10:07 zmproxyctl restart
1117 200731 16:10:47 exit
1118 200731 18:18:27 /opt/zimbra/libexec/zmdomaincertmgr savecrt .ae mail.*.ae.bundle privkey.pem
1119 200731 18:22:46 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1120 200731 18:23:59 zmproxyctl restart
1121 200731 18:25:22 cd /etc/apache2
1122 200731 18:25:26 ls
1123 200731 18:25:44 ls sites-enabled
1124 200731 18:25:56 exit
1125 200731 18:47:46 exit
1126 200801 08:07:25 zmproxyctl restart
1127 200801 08:07:58 zmcontrol restart
1128 200801 08:10:27 /opt/zimbra/libexec/zmdomaincertmgr savecrt *.ae mail..ae.bundle privkey.pem
1129 200801 08:10:49 /opt/zimbra/libexec/zmdomaincertmgr deploycrts
1197 201117 19:03:44 zmcontrol restart
1198 201118 10:16:46 exit
1199 201122 14:46:01 zimbra status
1200 201122 14:46:11 status
1201 201122 14:46:26 /zimbra status
1202 201122 14:46:37 zmcontrol status
1203 201122 14:50:00 ▒exit
1204 201122 14:50:14 exit
1205 201122 14:58:19 zmcontrol restart
1206 201124 07:04:58 zmcontrol status
1207 201124 07:05:26 exit
1208 201126 07:09:26 zmcontrol status
1209 201126 07:09:46 zmcontrol restart
1210 201126 07:18:53 zmcontrol status
1211 201126 07:19:10 zmcontrol restart
1212 201126 07:32:48 zmcontrol status
1213 201128 10:52:22 certbot renew
1214 201128 10:52:48 sudo certbot renew
1215 201128 10:53:07 rgbvtr
1216 201128 10:53:14 exit
1217 201128 10:55:19 zmcontrol stop
1218 201128 10:56:24 exit
1219 201128 10:59:37 zmcontrol start
1220 201128 11:03:00 exit
1221 201128 11:16:21 zmcontrol status
1326 210102 07:47:44 history | grep -E '111|112'

#16

What happened that you are no longer installing your certs this way?

#17

before me the Administrator installed it. I am now writing certbot renew

#18

certbot renew is not enough for Zimbra.
You need to read the Zimbra documentation and follow their instructions to renew the cert and deploy it into Zimbra.