Installing a Comodo SSL Certificate on Zimbra Collaboration: Difference between revisions

No edit summary
No edit summary
Line 1: Line 1:
{{Archive}}{{WIP}}{{Article Infobox|{{admin}}||{{ZCS 5.0}}|}}== Installing a Comodo SSL certificate with zmcertmgr ==
{{WIP}}{{Article Infobox|{{admin}}|{{ZCS 8.6}}|{{ZCS 8.5}}|{{ZCS 8.0}}|}}
=Installing a Comodo SSL Certificate=
Use the article as a guide to installing a Comodo issued SSL certificate with the zmcertmgr tool or the Admin Console.
==Using the CLI==
* 1. Get the bundle from Comodo in crt format, or sometimes like a zip file.
* 2. Place the bundle on your Zimbra mailbox server.  You should receive the next files:
** AddTrustExternalCARoot.crt
** COMODORSAAddTrustCA.crt
** COMODORSADomainValidationSecureServerCA.crt
** my_domain_com.crt files


Use the article as a guide to installing a Comodo issued SSL certificate with the zmcertmgr tool.
'''Note''' the root and intermediate files may have different names depends of the SSL Certificate, like PositiveSSL, etc.


1. Get a Tomcat bundle from Comodo in PEM format.
* 3. Cat the CA certs to form a single CA certificate chain file
  cat AddTrustExternalCARoot.crt COMODORSAAddTrustCA.crt COMODORSADomainValidationSecureServerCA.crt > /tmp/commercial_ca.crt
* 4. Place the SSL certificate in /tmp/commercial.crt.
  cp my_domain_com.crt /tmp/commercial.crt
* 5. Check that your SSL certificate, your private key and the Intermediate CA are OK, this step is important and you should not continue if you receive an error here:
<pre>/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/commercial_ca.crt
** Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (/tmp/commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
Valid Certificate: /tmp/commercial.crt: OK</pre>
* 6. Deploy the commercial certificate with zmcertmgr as the root user.
<pre>/opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/commercial_ca.crt
** Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (/tmp/commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
Valid Certificate: /tmp/commercial.crt: OK
** Copying /tmp/commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
** Appending ca chain /tmp/commercial_ca.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
** Importing certificate /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt to CACERTS as zcs-user-commercial_ca...done.
** NOTE: mailboxd must be restarted in order to use the imported certificate.
** Saving server config key zimbraSSLCertificate...done.
** Saving server config key zimbraSSLPrivateKey...done.
** Installing mta certificate and key...done.
** Installing slapd certificate and key...done.
** Installing proxy certificate and key...done.
** Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12...done.
** Creating keystore file /opt/zimbra/mailboxd/etc/keystore...done.
** Installing CA to /opt/zimbra/conf/ca...done.</pre>
* 7. Restart the Zimbra Services
zmcontrol restart


2. Place the bundle on your Zimbra mailbox server.  You should receive a ca_root.crt and ca_intermediate.crt files.  Note the root and intermediate files may have different names.
==Using the Admin Console==
Before install the SSL Certificate using the Admin Console, you should generated the CSR before following the steps indicated in the next Wiki:
* [[Administration_Console_and_CLI_Certificate_Tools#Generate_a_valid_CSR_.28Certificate_Signing_Request.29_for_a_Commercial_SSL|Generate a valid CSR (Certificate Signing Request) for a Commercial SSL]]


3. Cat the CA certs to form a single CA certificate chain file
You should receive the next files from Comodo:
  cat ca_root.crt ca_intermediate.crt > /tmp/ca_bundle.crt
** AddTrustExternalCARoot.crt
In the case of a PositiveSSL cert,
** COMODORSAAddTrustCA.crt
  cat PositiveSSLCA.crt UTNAddTrustServerCA.crt AddTrustExternalCARoot.crt > /tmp/ca_bundle.crt
** COMODORSADomainValidationSecureServerCA.crt
** my_domain_com.crt files


4. Place server certificate in /tmp/server.crt. For PositiveSSL, this will be the one in the form servername_domainname_tld.crt (e.g., www_example_com.crt)
Go to '''Home > Configure > Certificates''' and click in the settings icon, then click on '''Install Certificate'''
  cp www_example_com.crt /tmp/server.crt


5. Deploy the commercial certificate with zmcertmgr as the root user.
[[File:Zimbra-ssl-adminconsole-001.png|800px]]
  cd /opt/zimbra/bin
  ./zmcertmgr deploycrt comm /tmp/server.crt /tmp/ca_bundle.crt


{{Article Footer|Zimbra Collaboration Suite 5.x|9/2/2008}}
Select the target server where install the SSL Certificate:
 
[[File:Zimbra-ssl-adminconsole-002.png|800px]]
 
Select the option '''Install the commercial signed certificate'''
 
[[File:Zimbra-ssl-adminconsole-007.png|800px]]
 
If all the info in the review windows is ok, press Next button
 
[[File:Zimbra-ssl-adminconsole-008.png|800px]]
 
Add the files one by one that Comodo sent to you, the Certificate, the root, and the CA:
 
[[File:Zimbra-ssl-adminconsole-009.png|800px]]
 
Select Install button and the SSL Certificate will be installed
 
[[File:Zimbra-ssl-adminconsole-010.png|800px]]
 
Restart the Zimbra services like zimbra user in a CLI session:
zmcontrol restart
 
You can return to the Admin Console and View the installed Certificate
 
[[File:Zimbra-ssl-adminconsole-011.png|800px]]
 
{{Article Footer|Zimbra Collaboration 8.x, 8.0.x, 7.x|9/2/2008}}


[[Category: Certificates]]
[[Category: Certificates]]
[[Category: ZCS 5.0]]

Revision as of 11:29, 29 June 2015

Admin Article

Article Information

This article applies to the following ZCS versions.

ZCS 8.6 Article ZCS 8.6 ZCS 8.5 Article ZCS 8.5 ZCS 8.0 Article ZCS 8.0


Installing a Comodo SSL Certificate

Use the article as a guide to installing a Comodo issued SSL certificate with the zmcertmgr tool or the Admin Console.

Using the CLI

  • 1. Get the bundle from Comodo in crt format, or sometimes like a zip file.
  • 2. Place the bundle on your Zimbra mailbox server. You should receive the next files:
    • AddTrustExternalCARoot.crt
    • COMODORSAAddTrustCA.crt
    • COMODORSADomainValidationSecureServerCA.crt
    • my_domain_com.crt files

Note the root and intermediate files may have different names depends of the SSL Certificate, like PositiveSSL, etc.

  • 3. Cat the CA certs to form a single CA certificate chain file
 cat AddTrustExternalCARoot.crt COMODORSAAddTrustCA.crt COMODORSADomainValidationSecureServerCA.crt > /tmp/commercial_ca.crt
  • 4. Place the SSL certificate in /tmp/commercial.crt.
 cp my_domain_com.crt /tmp/commercial.crt
  • 5. Check that your SSL certificate, your private key and the Intermediate CA are OK, this step is important and you should not continue if you receive an error here:
/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/commercial_ca.crt 
** Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (/tmp/commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
Valid Certificate: /tmp/commercial.crt: OK
  • 6. Deploy the commercial certificate with zmcertmgr as the root user.
/opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/commercial_ca.crt 
** Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (/tmp/commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
Valid Certificate: /tmp/commercial.crt: OK
** Copying /tmp/commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
** Appending ca chain /tmp/commercial_ca.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
** Importing certificate /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt to CACERTS as zcs-user-commercial_ca...done.
** NOTE: mailboxd must be restarted in order to use the imported certificate.
** Saving server config key zimbraSSLCertificate...done.
** Saving server config key zimbraSSLPrivateKey...done.
** Installing mta certificate and key...done.
** Installing slapd certificate and key...done.
** Installing proxy certificate and key...done.
** Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12...done.
** Creating keystore file /opt/zimbra/mailboxd/etc/keystore...done.
** Installing CA to /opt/zimbra/conf/ca...done.
  • 7. Restart the Zimbra Services
zmcontrol restart

Using the Admin Console

Before install the SSL Certificate using the Admin Console, you should generated the CSR before following the steps indicated in the next Wiki:

You should receive the next files from Comodo:

    • AddTrustExternalCARoot.crt
    • COMODORSAAddTrustCA.crt
    • COMODORSADomainValidationSecureServerCA.crt
    • my_domain_com.crt files

Go to Home > Configure > Certificates and click in the settings icon, then click on Install Certificate

Zimbra-ssl-adminconsole-001.png

Select the target server where install the SSL Certificate:

Zimbra-ssl-adminconsole-002.png

Select the option Install the commercial signed certificate

Zimbra-ssl-adminconsole-007.png

If all the info in the review windows is ok, press Next button

Zimbra-ssl-adminconsole-008.png

Add the files one by one that Comodo sent to you, the Certificate, the root, and the CA:

Zimbra-ssl-adminconsole-009.png

Select Install button and the SSL Certificate will be installed

Zimbra-ssl-adminconsole-010.png

Restart the Zimbra services like zimbra user in a CLI session:

zmcontrol restart

You can return to the Admin Console and View the installed Certificate

Zimbra-ssl-adminconsole-011.png

Verified Against: Zimbra Collaboration 8.x, 8.0.x, 7.x Date Created: 9/2/2008
Article ID: https://wiki.zimbra.com/index.php?title=Installing_a_Comodo_SSL_Certificate_on_Zimbra_Collaboration Date Modified: 2015-06-29



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »

Jump to: navigation, search