Category:Community Sandbox: Difference between revisions
m (Blanked the page) |
No edit summary |
||
Line 1: | Line 1: | ||
=JDunphy Letsencrypt - Another Method Using acme.sh to Generate Certs= | |||
{{KB|{{Unsupported}}|{{ZCS 8.8}}|{{ZCS 8.7}}|{{ZCS 8.6}}|}} | |||
{{WIP}} | |||
= Introduction = | |||
Letsencrypt is a free, automated, and open Certificate Authority to generate all your PKI certificates so a browser can see & display that trusted green secure lock for your domains. Instead of installing a development environment like other Letsencrypt methods, this article describes a single bash script and can be installed and operated without being root. Here is how to get Zimbra up and running with your Letsencrypt certificate. | |||
= Requirements (1 time only)= | |||
# Install acme.sh bash script in your home directory. Ref: https://github.com/Neilpang/acme.sh | |||
<pre> | |||
% curl https://get.acme.sh | sh | |||
Or: | |||
% wget -O - https://get.acme.sh | sh | |||
</pre> | |||
Note: This will do three things. | |||
# create a directory ~/.acme.sh | |||
# update your .cshrc and .bashrc so that script is in your path | |||
# create a cron job for the local user for automatic renewal | |||
= Issue Your Certificate = | |||
Letsencrypt needs to verify you have control of your domains before they will sign your certificate. To do that, we complete a challenge and prove we have control of the domains using their acme protocol. The acme.sh script supports all challenge methods but for this article we will focus on the Automatic DNS challenge. See https://github.com/Neilpang/acme.sh for other methods or my own documentation https://github.com/JimDunphy/deploy-zimbra-letsencrypt.sh/tree/master/Recipies/SingleServer which lists 3 different type of DNS methods. All methods that acme.sh supports work with this article. | |||
When using the '''Automatic DNS Method''' for the first time, you will need to update '''~/.acme.sh/account.conf''' to contain your DNS provider api key. A list of supported DNS providers can be found at ~/.acme.sh/dnsapi. In this article we will use CloudFlare. Login to your CloudFlare account to get your API key before proceeding and then add these 2 lines to your '''~/.acme.sh/account.conf file''' | |||
# SAVED_CF_Key= '......Your API key..........' | |||
# CF_EMAIL='XXXX@example.com' | |||
From now on, anytime we need a certificate or renew a certificate we can do the following: | |||
<pre> | |||
acme.sh --issue --dns dns_cf -d mail.example.com | |||
</pre> | |||
If we have multiple domains associated with our Zimbra server, then it works like this: | |||
<pre> | |||
acme.sh --issue --dns dns_cf -d mail.example.com -d mail.example.net -d mail.example.org | |||
</pre> | |||
Wild card certs are supported with ACME v2 protocol | |||
<pre> | |||
acme.sh --issue --dns dns_cf -d mail.example.com -d '*.example.com' | |||
</pre> | |||
Your certificates can be found at: ~/.acme.sh/mail.example.com ... It uses the first '-d' name to create a directory to store your certificates | |||
= Install Certificate With Zimbra = | |||
Regardless of which challenge method you used with the acme.sh bash script, the following commands will install it. Note: I have also created a script to perform these steps automatically at https://github.com/JimDunphy/deploy-zimbra-letsencrypt.sh and the forums have a thread on this method https://forums.zimbra.org/viewtopic.php?f=15&t=60781 for additional background information. For this article we walk through those steps. | |||
= Step 1 (Append IdentTrust CERT to fullchain) | |||
<pre> | |||
cd ~/.acme.sh/example.com | |||
echo '-----BEGIN CERTIFICATE----- | |||
MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ | |||
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT | |||
DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow | |||
PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD | |||
Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB | |||
AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O | |||
rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq | |||
OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b | |||
xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw | |||
7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD | |||
aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV | |||
HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG | |||
SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69 | |||
ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr | |||
AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz | |||
R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5 | |||
JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo | |||
Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ | |||
-----END CERTIFICATE-----' >> fullchain.cer | |||
</pre> | |||
Because zmcertmgr will chdir during install which can abort when permissions are incorrect in some circumstances, we do the following. | |||
<pre> | |||
% cd .acme.sh/mail.example.com | |||
% cp mail.example.com.key mail.example.com.cer fullchain.cer /tmp | |||
</pre> | |||
= Note: | |||
For version 8.7 and above, zmcertmgr runs as zimbra. For all earlier versions you will run zmcertmgr as root. Example below is for 8.7 and 8.8 versions. | |||
= Step 2 Verify your certificate | |||
<pre> | |||
% su - zimbra | |||
% cd /tmp | |||
% /opt/zimbra/bin/zmcertmgr verifycrt mail.example.com.key mail.example.com.cer fullchain.cer | |||
</pre> | |||
If there were no errors, you can install the certificate | |||
= Step 3 Install your certificate | |||
<pre> | |||
% su - zimbra | |||
% cd /tmp | |||
% cp mail.example.key /opt/zimbra/ssl/zimbra/commercial/commercial.key | |||
% /opt/zimbra/bin/zmcertmgr deploycrt comm mail.example.cer fullchain.cer | |||
</pre> | |||
If there were no errors, proceed to restart zimbra | |||
= Step 4 Restart Zimbra | |||
<pre> | |||
% su - zimbra | |||
% zmcontrol restart | |||
</pre> |
Revision as of 22:30, 19 July 2018
JDunphy Letsencrypt - Another Method Using acme.sh to Generate Certs
Introduction
Letsencrypt is a free, automated, and open Certificate Authority to generate all your PKI certificates so a browser can see & display that trusted green secure lock for your domains. Instead of installing a development environment like other Letsencrypt methods, this article describes a single bash script and can be installed and operated without being root. Here is how to get Zimbra up and running with your Letsencrypt certificate.
Requirements (1 time only)
- Install acme.sh bash script in your home directory. Ref: https://github.com/Neilpang/acme.sh
% curl https://get.acme.sh | sh Or: % wget -O - https://get.acme.sh | sh
Note: This will do three things.
- create a directory ~/.acme.sh
- update your .cshrc and .bashrc so that script is in your path
- create a cron job for the local user for automatic renewal
Issue Your Certificate
Letsencrypt needs to verify you have control of your domains before they will sign your certificate. To do that, we complete a challenge and prove we have control of the domains using their acme protocol. The acme.sh script supports all challenge methods but for this article we will focus on the Automatic DNS challenge. See https://github.com/Neilpang/acme.sh for other methods or my own documentation https://github.com/JimDunphy/deploy-zimbra-letsencrypt.sh/tree/master/Recipies/SingleServer which lists 3 different type of DNS methods. All methods that acme.sh supports work with this article.
When using the Automatic DNS Method for the first time, you will need to update ~/.acme.sh/account.conf to contain your DNS provider api key. A list of supported DNS providers can be found at ~/.acme.sh/dnsapi. In this article we will use CloudFlare. Login to your CloudFlare account to get your API key before proceeding and then add these 2 lines to your ~/.acme.sh/account.conf file
- SAVED_CF_Key= '......Your API key..........'
- CF_EMAIL='XXXX@example.com'
From now on, anytime we need a certificate or renew a certificate we can do the following:
acme.sh --issue --dns dns_cf -d mail.example.com
If we have multiple domains associated with our Zimbra server, then it works like this:
acme.sh --issue --dns dns_cf -d mail.example.com -d mail.example.net -d mail.example.org
Wild card certs are supported with ACME v2 protocol
acme.sh --issue --dns dns_cf -d mail.example.com -d '*.example.com'
Your certificates can be found at: ~/.acme.sh/mail.example.com ... It uses the first '-d' name to create a directory to store your certificates
Install Certificate With Zimbra
Regardless of which challenge method you used with the acme.sh bash script, the following commands will install it. Note: I have also created a script to perform these steps automatically at https://github.com/JimDunphy/deploy-zimbra-letsencrypt.sh and the forums have a thread on this method https://forums.zimbra.org/viewtopic.php?f=15&t=60781 for additional background information. For this article we walk through those steps.
= Step 1 (Append IdentTrust CERT to fullchain)
cd ~/.acme.sh/example.com echo '-----BEGIN CERTIFICATE----- MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw 7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69 ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5 JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ -----END CERTIFICATE-----' >> fullchain.cer
Because zmcertmgr will chdir during install which can abort when permissions are incorrect in some circumstances, we do the following.
% cd .acme.sh/mail.example.com % cp mail.example.com.key mail.example.com.cer fullchain.cer /tmp
= Note: For version 8.7 and above, zmcertmgr runs as zimbra. For all earlier versions you will run zmcertmgr as root. Example below is for 8.7 and 8.8 versions.
= Step 2 Verify your certificate
% su - zimbra % cd /tmp % /opt/zimbra/bin/zmcertmgr verifycrt mail.example.com.key mail.example.com.cer fullchain.cer
If there were no errors, you can install the certificate
= Step 3 Install your certificate
% su - zimbra % cd /tmp % cp mail.example.key /opt/zimbra/ssl/zimbra/commercial/commercial.key % /opt/zimbra/bin/zmcertmgr deploycrt comm mail.example.cer fullchain.cer
If there were no errors, proceed to restart zimbra
= Step 4 Restart Zimbra
% su - zimbra % zmcontrol restart
Subcategories
This category has the following 2 subcategories, out of 2 total.
Pages in category "Community Sandbox"
The following 200 pages are in the current category.
(previous page) (next page)I
J
K
- Kauzz-notes
- Template:KB
- King0770-Notes-Access GAL from Clients 6.0
- King0770-Notes-Account-Organization
- King0770-Notes-Always Bcc-Mishap
- King0770-Notes-Borderware-LDAP-Config
- King0770-Notes-Bulk Upload To Briefcase
- King0770-Notes-Calendar-Notes
- King0770-Notes-Cannot-Start-ldap-ldap starttls supported-Enabled
- King0770-Notes-Chameleon-Skin
- King0770-Notes-Change-LDAP-Log-Levels
- King0770-Notes-Check-Submission-Port-587
- King0770-Notes-Directory-Permissions-on-tmp
- King0770-Notes-Disable-Zimbra-Desktop
- King0770-Notes-Download-JDK
- King0770-Notes-Drop-Single-Mboxgroup-and-Reimport
- King0770-Notes-Emulate-a-user-login-via-the-command-line
- King0770-Notes-error-decoding-message
- King0770-Notes-Export And Import Spamassassin Rules
- King0770-Notes-External-Authentication-with-LDAP
- King0770-Notes-Find Out When Message Was Read
- King0770-Notes-FireFox MimeTypes
- King0770-Notes-Force-Authentication-With-Full-Email-Address
- King0770-Notes-Handy-Links
- King0770-Notes-Header-Checks
- King0770-Notes-import-SSL
- King0770-Notes-InnoDB is in the future
- King0770-Notes-Installing-Proxy-For-Single-Server
- King0770-Notes-Internal-False-Positives
- King0770-Notes-ldap-fragmentation
- King0770-Notes-ldapsearch-to-csv
- King0770-Notes-Lock-All-Accounts
- King0770-Notes-Mass-Account-Removal
- King0770-Notes-Merge Two Independent Machines
- King0770-Notes-Milter And DistributionLists
- King0770-Notes-MovingUsers
- King0770-Notes-MTA-ALLOW-HELO
- King0770-Notes-NG Modules
- King0770-Notes-Old-Misc-Commands
- King0770-Notes-Outbound SMTP Authentication Using Port 465
- King0770-Notes-Postconf or localconfig
- King0770-Notes-Prevent-Accounts-From-Sending-To-External-Domains-With-CBPOLICYD
- King0770-Notes-Quick-Guide-Setting-Up-ZCS-8.8.15 And NextCloud17
- King0770-Notes-Read-the-install-history-file-in-a-readable-format
- King0770-Notes-Rejecting-Nested-From-Addresses
- King0770-Notes-Relocated-Maps
- King0770-Notes-Removal of Bad Contact Address
- King0770-Notes-Remove-Orphaned-Account
- King0770-Notes-Removing-Messages-with-zmmailbox-based-on-Subject
- King0770-Notes-rsync-excludes
- King0770-Notes-SearchGal-Edit
- King0770-Notes-Setup-RateLimiting-with-CBPOLICYD
- King0770-Notes-smtp tls policy maps
- King0770-Notes-SpamTitan
- King0770-Notes-Ultra-Restrictive-Sending-And-Receiving
- King0770-Notes-Verify-LDAP-Passwords
- King0770-Notes-When innodb force recovery Fails
- King0770-Notes-Whitelist-Phishing-Service
- King0770-Notes-Whitelist-Spamassassin-MTA
- King0770-Notes-YAMM
- King0770-Notes-ZCO-Repair
- King0770-Notes-Zimbra-Connect
- King0770-Notes-zmtrainsa cleanup host
- Kwinke-Notes
- KyaPanel with Zimbra
L
M
- Mail client Configuration
- Mail Client LDAP Configuration
- Mail Injection Stress Test
- Mail Migration
- Mail Queue Monitoring
- Mailbox Purge
- Mailbox Troubleshooting
- Mailbox usage report
- Maildir to zmmailbox with bash
- Making Zimbra run on minimal RAM
- Manage Certificate SOAP
- Managing Domains
- Mapping Folders
- Maumar-Notes
- Mbox to maildir with Python
- MeneM-Notes
- Message Cache
- Message Flags
- Mgolfieri Disable password autocompletion
- Mgolfieri Provisioning with a username unrelated to any email address
- Mgolfieri- Admin notification emails
- Mgolfieri-GalSyncAccount notes
- Migrating from 32 bit Centos 4.x to 64 bit Centos 5.x
- Migrating from Dovecot passwd with bash
- Migrating from Dovecot with External LDAP
- Migrating from End of Life Platform to Supported Platform
- Migrating from Exchange
- Mikew-Notes
- Missing Contacts From Share Contact Group
- Mobile Device Support Table
- Mobile web browser
- Modified Rsync Migration
- Monitoring Tools Articles
- Monitoring Zimbra Collaboration - InfluxDB, Telegraf and Grafana
- Monitoring Zimbra Collaboration Nagios
- Move messages to new secondary volume
- Moving ZDB File To Another Location
- MTA
- MySQL Backup and Restore
O
P
- Per User Mailbox Backup (OE Version)
- Performance Tuning Guidelines for Single-Server 100-500 User Systems
- Plobbes-Handling-System-Mail
- Plobbes-Higher-Availability
- Plus Addressing
- Postfix PCI Compliance in ZCS
- Preauth
- Preparing to Use the Migration Wizard
- Preserving Original Date when Importing EML Archive
- Prevent duplicates messages for POP3 users post migration
- Provide HTTP(s) Integration with Apache
R
- Rebranding and Themes
- Rebranding Articles
- RecommendedResetYourGlobalAddressList
- Rejecting false "mail from" addresses
- Relay per Domain
- Remote-Commands-from-Windows-to-Zimbra
- Removing A Mailstore
- Removing-Backups-In-Zimbra
- Repairing ZCS Connector for Outlook
- Resetting LDAP and MySQL Passwords
- Resetting Your Mobile Device
- REST File Formats
- Restore-Quarantined-Emails
- Restoring a Single User from Backups Archived to Tape
- Restrict Admin 'View Mail'
- Restrict sending to certain domains
- Restrict users to certain domain
- RestrictPostfixSenders
- Rolling Upgrades Overview
- Rspamd
- Running Kerberos with Zimbra Collaboration Suite
- Running Migration Wizard
- Russianspi-Notes
S
- Sandbox
- Scheduling-Backups-In-Zimbra
- Scotty-Notes
- Scripts to sync to a remote Zimbra backup machine
- SeanG-Notes
- Search deleted accounts
- Self-Signed-CA-SSL-CRT
- Send Receive fax ZCS Hylafax
- SendAs sendOnBehalfOf
- Sending mail through an external relay
- Separation Of WebApp Service From Mailstore In ZCS8.5
- Server Live sync
- Server Monitoring
- Server status inconsistent if /etc/mysql/conf.d does not exist
- Setting automatic Default Signature
- Setting Thresholds for Disk Monitoring