ZIMBRA won't install LE cert

Pooja15 · August 22, 2021, 5:06am

Hello,

When I tried to install let's encrypt SSL, it shows the below error
"** Verifying 'cert.pem' against 'fullchain.pem'
ERROR: Unable to validate certificate chain: cert.pem: C = US, O = Internet Security Research Group, CN = ISRG Root X1
error 2 at 2 depth lookup:unable to get issuer certificate"

please help me to resolve this.

rg305 · August 22, 2021, 5:15am

Hi @Pooja15, welcome to the LE community forum

Which ACME client (and version) are you using?
What command did you run exactly?

It is very strange to see cert.pem being verified against fullchain.pem:

Are you using ZIMBRA?
If so, trying reading through this topic:

Pooja15 · August 22, 2021, 5:55am

Actually, I am not very familiar with the Zimbra server management, i am trying to install ssl on the zimra installed domain. But whe i used my cloudflare SSL on it, it didn't work. So i have used the Let's encrypt SSL on the domain using the below command
"/opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem"
ERROR: Can't read file '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt'

and
"/opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem"
ERROR: Unable to validate certificate chain: cert.pem: C = US, O = Internet Security Research Group, CN = ISRG Root X1
error 2 at 2 depth lookup:unable to get issuer certificate

rg305 · August 22, 2021, 6:26am

Did you read the other topic I posted above?

Pooja15 · August 22, 2021, 6:39am

yes, but my cert and ca verification do not matches
"** Verifying 'cert.pem' against 'chain.pem'
ERROR: Unable to validate certificate chain: cert.pem: C = US, O = Internet Security Research Group, CN = ISRG Root X1
error 2 at 2 depth lookup:unable to get issuer certificate
[zimbra@mail letsencrypt]$
"

rg305 · August 22, 2021, 6:47am

That is a very well known problem with ZIMBRA.
If you post your public fullchain.pem file here I can build you an "LE.CA.pem" file to use with it.

rg305 · August 22, 2021, 7:29am

OK.
Make these three certs into file "LE.CA.pem"

rg305 · August 22, 2021, 7:30am

Then try and show the output of:
/opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem LE.CA.pem

Pooja15 · August 22, 2021, 7:48am

Yes, ssl installed successfully. THank you so much.

Can you please help me to set cron for this ssl renewation also.

rg305 · August 22, 2021, 7:53am

Let me see what a can throw together...
Please show the output of:
certbot certificates

Pooja15 · August 22, 2021, 8:03am

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Found the following certs:
Certificate Name: domain-0001
Serial Number: 373c4a5b82598b93de277a4f5dbfbd45df8
Key Type: RSA
Domains: domain
Expiry Date: 2021-11-17 10:49:09+00:00 (VALID: 87 days)
Certificate Path: /etc/letsencrypt/live/domain/fullchain.pem
Private Key Path: /etc/letsencrypt/live/domain/privkey.pem
Certificate Name: domain
Serial Number: 373c4a5b82598b93de277a4f5dbfbd45df8
Key Type: RSA
Domains: domain
Expiry Date: 2021-11-17 10:49:09+00:00 (VALID: 87 days)
Certificate Path: /etc/letsencrypt/live/domain/fullchain.pem
Private Key Path: /etc/letsencrypt/live/domain/privkey.pem

rg305 · August 22, 2021, 8:20am

OMG!
That can't be right.
Both certs are pointing to the exact same path and have the exact same expiration and serial number!

Did you paste that in twice?

rg305 · August 22, 2021, 8:22am

Look here is what I have so far:
[I really need to get some sleep now - best of luck to you]

To update ZIMBRA

Save the following as file: update.ZIMBRA.LE-cert.sh
[make it executable and run it as root (not as zimbra user)]

#!/bin/bash
# zimbra user may not have access to LE files, so we copy them
cp /etc/letsencrpyt/live/YOUR.SITE/* /opt/zimbra/ssl/letsencrypt/

# verify the cert
su - zimbra -c "/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/letsencrypt/privkey.pem /opt/zimbra/ssl/letsencrypt/cert.pem /opt/zimbra/ssl/letsencrypt/LE.CA.pem"

# deploy the cert
# zimbra needs the private key to be at a specific location and name
cp /opt/zimbra/ssl/letsencrypt/privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key
su - zimbra -c "/opt/zimbra/bin/zmcertmgr deploycrt comm /opt/zimbra/ssl/letsencrypt/cert.pem /opt/zimbra/ssl/letsencrypt/LE.CA.pem"

Once you get it to work, you can trigger that file from certbot with a --deploy-hook
The cron job itself need only call:
certbot renew

griffin · August 22, 2021, 9:35am

Me thinks this is either a manual "backup" situation or certbot creating a duplicate renewal configuration.

Pooja15 · August 22, 2021, 9:51am

THank you @rg305
ssl works fine, i will try to set cron.

Pooja15 · August 22, 2021, 9:53am

Also can u please tell me the way to convert the fullchain.pem to LE.CA.pem

griffin · August 22, 2021, 10:03am

fullchain.pem is these three certificates:

your leaf certificate
R3 (signed by ISRG Root X1)
ISRG Root X1 (signed by DST Root CA X3)

LE.CA.pem is these three certificates:

R3 (signed by ISRG Root X1)
ISRG Root X1 (signed by DST Root CA X3)
DST Root CA X3 (self-signed)

So, essentially, you just strip your leaf certificate off the top of fullchain.pem then append DST Root CA X3 to the bottom.

Alternatively, you could just append DST Root CA X3 to the bottom of chain.pem.

rg305 · August 22, 2021, 9:01pm

Yes, essentially "LE.CA.pem" is "fullchain.pem" minus the first ("cert.pem") and containing the root cert.
So, in more explicit terms, it's really a "complete-fullchain-only.pem" or "chain-plus-root-only.pem".
Needed certs:

(1) = leaf cert (cert.pem)
(2) & (3) = intermediates (chain.pem)
(4) = root cert (not provided by ACME clients; as it should be in the root store - but ZIMBRA still requires it)

ZIMBRA requires them in ALL in two files:
[which are not fully provided in that exact format by certbot (or any other ACME client)]

(1) in cert.pem
(2) & (3) & (4) in our created LE.CA.pem

If ZIMBRA could get their... coding straight, we wouldn't need to do any of this.

system · September 21, 2021, 9:02pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.