Zimbra renewal - Problems with R3

Help
51

Hi Everyone,
I use Ubuntu 16.04.7 LTS
OpenSSL 1.1.0h
Zimbra 8.8.15_GA
removed all old archives /etc/letsencrypt/archive/mydomain ; /etc/letsencrypt/live/mydomain

Downloaded latest version certbot-1.19.0/
./letsencrypt-auto certonly --standalone --non-interactive --agree-tos --preferred-chain "ISRG Root X1" -d mydomain1.com -dmydomain2.com
after created files:
/etc/letsencrypt/live/mydomain/fullchain.pem, privkey.pem, chain.pem, cert.pem

copy all files with /etc/letsencrypt/live/mydomain/* to /opt/zimbra/ssl/letsencrypt/mydomain/

cp /etc/letsencrypt/live/mydomain/* /opt/zimbra/ssl/letsencrypt/mydomain/
cd /opt/zimbra/ssl/letsencrypt/mydomain/
wget -O /tmp/ISRG-X1.pem https://letsencrypt.org/certs/isrgrootx1.pem.txt
cat /tmp/ISRG-X1.pem >> /opt/zimbra/ssl/letsencrypt/mydomain/chain.pem
cp /opt/zimbra/ssl/letsencrypt/mydomain/privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
chown zimbra:zimbra /opt/zimbra/ssl/zimbra/commercial/commercial.key

after open zimbra user (su - zimbra)

cd ~
/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/zimbra/ssl/letsencrypt/mydomain/cert.pem /opt/zimbra/ssl/letsencrypt/mydomain/chain.pem

** Verifying 'cert.pem' against 'privkey.pem'
Certificate 'cert.pem' and private key 'privkey.pem' match.
** Verifying 'cert.pem' against 'chain.pem'
ERROR: Unable to validate certificate chain: C = US, O = Internet Security Research Group, CN = ISRG Root X1
error 2 at 2 depth lookup: unable to get issuer certificate
error cert.pem: verification failed

check
$ openssl crl2pkcs7 -nocrl -certfile chain.pem | openssl pkcs7 -noout -print_certs
subject=C = US, O = Let's Encrypt, CN = R3
issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1
subject=C = US, O = Internet Security Research Group, CN = ISRG Root X1
issuer=O = Digital Signature Trust Co., CN = DST Root CA X3
subject=C = US, O = Internet Security Research Group, CN = ISRG Root X1
issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1

Please help solve this problem...
does it make sense to upgrade to version Ubuntu 18 LTS and OpenSSL
Thanks all

1 Like