Category:Community Sandbox

Revision as of 22:30, 19 July 2018 by JDunphy (talk | contribs)

JDunphy Letsencrypt - Another Method Using to Generate Certs

   KB 2441        Last updated on 2018-07-19  

(0 votes)


Letsencrypt is a free, automated, and open Certificate Authority to generate all your PKI certificates so a browser can see & display that trusted green secure lock for your domains. Instead of installing a development environment like other Letsencrypt methods, this article describes a single bash script and can be installed and operated without being root. Here is how to get Zimbra up and running with your Letsencrypt certificate.

Requirements (1 time only)

  1. Install bash script in your home directory. Ref:
% curl | sh
% wget -O - | sh

Note: This will do three things.

  1. create a directory ~/
  2. update your .cshrc and .bashrc so that script is in your path
  3. create a cron job for the local user for automatic renewal

Issue Your Certificate

Letsencrypt needs to verify you have control of your domains before they will sign your certificate. To do that, we complete a challenge and prove we have control of the domains using their acme protocol. The script supports all challenge methods but for this article we will focus on the Automatic DNS challenge. See for other methods or my own documentation which lists 3 different type of DNS methods. All methods that supports work with this article.

When using the Automatic DNS Method for the first time, you will need to update ~/ to contain your DNS provider api key. A list of supported DNS providers can be found at ~/ In this article we will use CloudFlare. Login to your CloudFlare account to get your API key before proceeding and then add these 2 lines to your ~/ file

  1. SAVED_CF_Key= '......Your API key..........'
  2. CF_EMAIL=''

From now on, anytime we need a certificate or renew a certificate we can do the following: --issue --dns dns_cf -d

If we have multiple domains associated with our Zimbra server, then it works like this: --issue --dns dns_cf -d -d -d 

Wild card certs are supported with ACME v2 protocol --issue --dns dns_cf -d -d '*'

Your certificates can be found at: ~/ ... It uses the first '-d' name to create a directory to store your certificates

Install Certificate With Zimbra

Regardless of which challenge method you used with the bash script, the following commands will install it. Note: I have also created a script to perform these steps automatically at and the forums have a thread on this method for additional background information. For this article we walk through those steps.

= Step 1 (Append IdentTrust CERT to fullchain)

cd ~/ 
echo '-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----' >> fullchain.cer

Because zmcertmgr will chdir during install which can abort when permissions are incorrect in some circumstances, we do the following.

% cd
% cp fullchain.cer /tmp

= Note: For version 8.7 and above, zmcertmgr runs as zimbra. For all earlier versions you will run zmcertmgr as root. Example below is for 8.7 and 8.8 versions.

= Step 2 Verify your certificate

% su - zimbra
% cd /tmp
% /opt/zimbra/bin/zmcertmgr verifycrt fullchain.cer

If there were no errors, you can install the certificate

= Step 3 Install your certificate

% su - zimbra
% cd /tmp
% cp mail.example.key /opt/zimbra/ssl/zimbra/commercial/commercial.key
% /opt/zimbra/bin/zmcertmgr deploycrt comm mail.example.cer fullchain.cer

If there were no errors, proceed to restart zimbra

= Step 4 Restart Zimbra

% su - zimbra
% zmcontrol restart


This category has the following 2 subcategories, out of 2 total.

Pages in category "Community Sandbox"

The following 200 pages are in the current category.

(previous page) (next page)


(previous page) (next page)
Jump to: navigation, search