Installing a Comodo SSL Certificate on Zimbra Collaboration: Difference between revisions
(New page: == Installing a Comodo SSL certificate with zmcertmgr == Use the article as a guide to installing a Comodo issued SSL certificate with the zmcertmgr tool. 1. Get a Tomcat bundle from C...) |
m (→Using the CLI) |
||
(17 intermediate revisions by 5 users not shown) | |||
Line 1: | Line 1: | ||
== Installing a Comodo SSL certificate with zmcertmgr == | {{BC|Certified}} | ||
__FORCETOC__ | |||
<div class="col-md-12 ibox-content"> | |||
= Installing a Comodo SSL Certificate on Zimbra Collaboration= | |||
{{KB|{{ZC}}|{{ZCS 8.8}}|{{ZCS 8.7}}|{{ZCS 8.6}}|}} | |||
{{WIP}} | |||
=Installing a Comodo SSL Certificate= | |||
Use the article as a guide to installing a Comodo issued SSL certificate with the zmcertmgr tool or the Admin Console. | |||
==Using the CLI== | |||
* 1. Get the bundle from Comodo in crt format, or sometimes like a zip file. Is always good call or write Comodo and obtain the proper Bundle, but you can also download each file from the next URL (SHA2 files) - '''https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/620/1/''' | |||
* 2. Place the bundle on your Zimbra mailbox server. You should receive, or [https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/620/1/ download], the next files: | |||
** AddTrustExternalCARoot.crt | |||
** COMODORSAAddTrustCA.crt | |||
** COMODORSADomainValidationSecureServerCA.crt | |||
** my_domain_com.crt files | |||
'''Note''' the root and intermediate files may have different names depends of the SSL Certificate, like PositiveSSL, etc. | |||
'''Note 2''' all the below commands should be run '''as zimbra user starting ZCS 8.7 and above, and as a root user in ZCS 8.6 and below'''. | |||
* 3. Cat the CA certs to form a single CA certificate chain file | |||
cat AddTrustExternalCARoot.crt COMODORSAAddTrustCA.crt COMODORSADomainValidationSecureServerCA.crt > /tmp/commercial_ca.crt | |||
* 4. Place the SSL certificate in /tmp/commercial.crt. | |||
cp my_domain_com.crt /tmp/commercial.crt | |||
* 5. Check that your SSL certificate, your private key and the Intermediate CA are OK, this step is important and you should not continue if you receive an error here: | |||
<pre>/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/commercial_ca.crt | |||
** Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key | |||
Certificate (/tmp/commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match. | |||
Valid Certificate: /tmp/commercial.crt: OK</pre> | |||
* 6. Deploy the commercial certificate with zmcertmgr as the root user. | |||
<pre>/opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/commercial_ca.crt | |||
** Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key | |||
Certificate (/tmp/commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match. | |||
Valid Certificate: /tmp/commercial.crt: OK | |||
** Copying /tmp/commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt | |||
** Appending ca chain /tmp/commercial_ca.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt | |||
** Importing certificate /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt to CACERTS as zcs-user-commercial_ca...done. | |||
** NOTE: mailboxd must be restarted in order to use the imported certificate. | |||
** Saving server config key zimbraSSLCertificate...done. | |||
** Saving server config key zimbraSSLPrivateKey...done. | |||
** Installing mta certificate and key...done. | |||
** Installing slapd certificate and key...done. | |||
** Installing proxy certificate and key...done. | |||
** Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12...done. | |||
** Creating keystore file /opt/zimbra/mailboxd/etc/keystore...done. | |||
** Installing CA to /opt/zimbra/conf/ca...done.</pre> | |||
* 7. Restart the Zimbra Services | |||
zmcontrol restart | |||
==Using the Admin Console== | |||
Before install the SSL Certificate using the Admin Console, you should generated the CSR before following the steps indicated in the next Wiki: | |||
* [[Administration_Console_and_CLI_Certificate_Tools#Generate_a_valid_CSR_.28Certificate_Signing_Request.29_for_a_Commercial_SSL|Generate a valid CSR (Certificate Signing Request) for a Commercial SSL]] | |||
You should receive the next files from Comodo: | |||
** AddTrustExternalCARoot.crt | |||
** COMODORSAAddTrustCA.crt | |||
** COMODORSADomainValidationSecureServerCA.crt | |||
** my_domain_com.crt files | |||
Go to '''Home > Configure > Certificates''' and click in the settings icon, then click on '''Install Certificate''' | |||
[[File:Zimbra-ssl-adminconsole-001.png|800px]] | |||
Select the target server where install the SSL Certificate: | |||
[[File:Zimbra-ssl-adminconsole-002.png|800px]] | |||
Select the option '''Install the commercial signed certificate''' | |||
[[File:Zimbra-ssl-adminconsole-007.png|800px]] | |||
If all the info in the review windows is ok, press Next button | |||
[[File:Zimbra-ssl-adminconsole-008.png|800px]] | |||
Add the files one by one that Comodo sent to you, the Certificate, the root, and the CA: | |||
[[File:Zimbra-ssl-adminconsole-009.png|800px]] | |||
Select Install button and the SSL Certificate will be installed | |||
[[File:Zimbra-ssl-adminconsole-010.png|800px]] | |||
Restart the Zimbra services like zimbra user in a CLI session: | |||
zmcontrol restart | |||
You can return to the Admin Console and View the installed Certificate | |||
[[File:Zimbra-ssl-adminconsole-011.png|800px]] | |||
==Additional Content== | |||
* Community Thread about install a Comodo SSL Certificate - [https://community.zimbra.com/collaboration/f/1886/t/1139599 https://community.zimbra.com/collaboration/f/1886/t/1139599] | |||
{{Article Footer|Zimbra Collaboration 8.x, 8.0.x, 7.x|9/2/2008}} | |||
{{NeedSME|Jorge|SME2|Copyeditor}} | |||
[[Category: Certificates]] |
Latest revision as of 17:24, 18 January 2018
Installing a Comodo SSL Certificate on Zimbra Collaboration
Installing a Comodo SSL Certificate
Use the article as a guide to installing a Comodo issued SSL certificate with the zmcertmgr tool or the Admin Console.
Using the CLI
- 1. Get the bundle from Comodo in crt format, or sometimes like a zip file. Is always good call or write Comodo and obtain the proper Bundle, but you can also download each file from the next URL (SHA2 files) - https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/620/1/
- 2. Place the bundle on your Zimbra mailbox server. You should receive, or download, the next files:
- AddTrustExternalCARoot.crt
- COMODORSAAddTrustCA.crt
- COMODORSADomainValidationSecureServerCA.crt
- my_domain_com.crt files
Note the root and intermediate files may have different names depends of the SSL Certificate, like PositiveSSL, etc.
Note 2 all the below commands should be run as zimbra user starting ZCS 8.7 and above, and as a root user in ZCS 8.6 and below.
- 3. Cat the CA certs to form a single CA certificate chain file
cat AddTrustExternalCARoot.crt COMODORSAAddTrustCA.crt COMODORSADomainValidationSecureServerCA.crt > /tmp/commercial_ca.crt
- 4. Place the SSL certificate in /tmp/commercial.crt.
cp my_domain_com.crt /tmp/commercial.crt
- 5. Check that your SSL certificate, your private key and the Intermediate CA are OK, this step is important and you should not continue if you receive an error here:
/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/commercial_ca.crt ** Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key Certificate (/tmp/commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match. Valid Certificate: /tmp/commercial.crt: OK
- 6. Deploy the commercial certificate with zmcertmgr as the root user.
/opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/commercial_ca.crt ** Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key Certificate (/tmp/commercial.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match. Valid Certificate: /tmp/commercial.crt: OK ** Copying /tmp/commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt ** Appending ca chain /tmp/commercial_ca.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt ** Importing certificate /opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt to CACERTS as zcs-user-commercial_ca...done. ** NOTE: mailboxd must be restarted in order to use the imported certificate. ** Saving server config key zimbraSSLCertificate...done. ** Saving server config key zimbraSSLPrivateKey...done. ** Installing mta certificate and key...done. ** Installing slapd certificate and key...done. ** Installing proxy certificate and key...done. ** Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12...done. ** Creating keystore file /opt/zimbra/mailboxd/etc/keystore...done. ** Installing CA to /opt/zimbra/conf/ca...done.
- 7. Restart the Zimbra Services
zmcontrol restart
Using the Admin Console
Before install the SSL Certificate using the Admin Console, you should generated the CSR before following the steps indicated in the next Wiki:
You should receive the next files from Comodo:
- AddTrustExternalCARoot.crt
- COMODORSAAddTrustCA.crt
- COMODORSADomainValidationSecureServerCA.crt
- my_domain_com.crt files
Go to Home > Configure > Certificates and click in the settings icon, then click on Install Certificate
Select the target server where install the SSL Certificate:
Select the option Install the commercial signed certificate
If all the info in the review windows is ok, press Next button
Add the files one by one that Comodo sent to you, the Certificate, the root, and the CA:
Select Install button and the SSL Certificate will be installed
Restart the Zimbra services like zimbra user in a CLI session:
zmcontrol restart
You can return to the Admin Console and View the installed Certificate
Additional Content
- Community Thread about install a Comodo SSL Certificate - https://community.zimbra.com/collaboration/f/1886/t/1139599