My domain is: mymailserver.com (a mail server, not web-accessible) Followed the Zimbra-specific directions to update to the new chain here: Zimbra SkillZ: How to use Zimbra with Let’s Encrypt Certificates - Zimbra : Blog All seemed to work without errors. But when I used certbot to renew: certbo…

I have this working using the following for the chain.pem: -----BEGIN CERTIFICATE----- MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw WhcNMjUwOTE1MTYwM…

[image] norbinus: I also use an old version of Open SSL: OpenSSL 1.0.2l Please see: Old Let's Encrypt Root Certificate Expiration and OpenSSL 1.0.2 - OpenSSL Blog The currently recommended certificate chain as presented to Let’s Encrypt ACME clients when new certificates are issu…

[image] denos: I have this working using the following for the chain.pem: Worked for me as well. Thanks a lot.

@norbinus @denos Be aware that chain.pem (and fullchain.pem) will be replaced on their next renewal. If you want to continue using that shorter/alternate trust path chain, you must instruct the ACME client to do so. Which can be done with the added parameter: --preferred-chain "ISRG Root X1"

Thanks for your support in this matter, @rg305 You are totally right, manually replacing the chain.pem won't do in a fully automatized environment. Therefore, a colleague of mine used the snap version of certbot on centos7 and receives a different chain.pem: # openssl crl2pkcs7 -nocrl -certfile ch…

Hi @sphinx-nh welcome to the LE community forum :slight_smile: [image] sphinx-nh: Did I miss something along the way? certbot has been developed and matured over time. There have been: letsencrypt letsencrypt-auto certbot certbot-auto certbot (via snap) You need to check the version and …

Ah, that's a known pattern: the usual process of software development. :wink: Thanks for the hint regarding the version and the feature availability in certbot >=1.12. Of course I assumed that the documentation of the option in the help message indicates the availability. Sadly, the help text of ce…

You can also try using an alternate ACME client (like: acme.sh). And you don't have to uninstall one to install the other - they can coexist peacefully :slight_smile: Mind you, they will each store certs independent of each other - but if either works, I'd use that one.

Thanks for mentioning acme.sh - you are right, this would resolve our problem and is an option for small deployments. The decision for certbot are in regards to operation and organization. For example: we value the structure of certbot and how certificates are organized in the filesystem (/etc/lets…

Using the snap certbot in combination with the --preferred-chain 'ISRG Root X1' option (as suggested by @rg305 ) fixed our issue. In order to automatize the renew process - for hopefully another five years - we use the Github project letsencrypt-zimbra ( GitHub - VojtechMyslivec/letsencrypt-zimbra: Fi…

Zimbra renewal - Problems with R3

Help

DanishDaud November 4, 2021, 11:28am 56

Thanks! Its worked for me.

Topic		Replies	Views
Can somebody help me to solve the issue with Letsencrypt certificate for Zimbra? Help	28	6204	February 24, 2022
Since this last month, can't install zimbra certificate Help	27	2042	September 3, 2024
Unable to renew my LetsEncrypt Certificate for Zimbra Help	10	4271	December 24, 2021
ERROR: Unable to validate certificate chain: cert.pem: C = US, O Help	23	3818	July 30, 2022
Zimbra unable to get local issuer cert Help	20	978	September 3, 2024

Zimbra renewal - Problems with R3

Related topics