Difference between revisions of "Problem with Certificate can cause MTA Failure"

(Adding category)
(Putting formatting on headings)
Line 1: Line 1:
'''Issue:'''
+
=Issue: Problem with Certificate can cause MTA Failure=
  
Problem with Certificate can cause MTA Failure
+
==Symptom==
 
 
'''Symptom:'''
 
  
 
When MTA starts up, user will receive the following message in the /var/log/zimbra.log file:
 
When MTA starts up, user will receive the following message in the /var/log/zimbra.log file:
Line 15: Line 13:
 
Then the MTA (postfix) will stop functioning resulting in mail delivery failure (via lmtp and smtp).
 
Then the MTA (postfix) will stop functioning resulting in mail delivery failure (via lmtp and smtp).
  
'''Common Cause:'''
+
==Common Cause:==
  
 
CA chain can be appended in reverse creating invalid Certificate [ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ]
 
CA chain can be appended in reverse creating invalid Certificate [ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ]
Line 22: Line 20:
  
  
'''Workaround [5.0.1_GA or later]'''
+
===Workaround [5.0.1_GA or later]===
  
----------------------------------------------------------------------------------------------------------------------------------
+
====For Single-server and Multi-server ldap masters====
 
 
'''For Single-server and Multi-server ldap masters'''
 
 
    
 
    
 
     (a) Run as root: /opt/zimbra/bin/zmcertmgr createca -new
 
     (a) Run as root: /opt/zimbra/bin/zmcertmgr createca -new
Line 33: Line 29:
 
     (d) Run as root: su - zimbra zmcontrol stop; su - zimbra zmcontrol start
 
     (d) Run as root: su - zimbra zmcontrol stop; su - zimbra zmcontrol start
 
* Note, for zcs version 5.0.6 (c) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self
 
* Note, for zcs version 5.0.6 (c) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self
 
 
-----------------------------------------------------------------------------------------------------------------------------------
 
  
'''For Multi-Server: Run this on all other systems in the multi-server setup'''
+
====For Multi-Server: Run this on all other systems in the multi-server setup====
  
 
After doing the steps listed above on the ldap master, log into any different systems running postfix:
 
After doing the steps listed above on the ldap master, log into any different systems running postfix:
Line 46: Line 40:
 
* Note, for zcs version 5.0.6 (c) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self
 
* Note, for zcs version 5.0.6 (c) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self
  
-----------------------------------------------------------------------------------------------------------------------------------
+
===Workaround [5.0.0_GA]===
 
 
 
 
'''Workaround [5.0.0_GA]'''
 
  
 
Read this post: http://www.zimbra.com/forums/administrators/13927-if-you-have-trouble-zimbra-5-0-read.html
 
Read this post: http://www.zimbra.com/forums/administrators/13927-if-you-have-trouble-zimbra-5-0-read.html
Line 55: Line 46:
 
Alternate: http://www.zimbra.com/forums/installation/13898-argh-commercial-certificates-after-4-10-5-0-foss-upgrade.html
 
Alternate: http://www.zimbra.com/forums/installation/13898-argh-commercial-certificates-after-4-10-5-0-foss-upgrade.html
  
-----------------------------------------------------------------------------------------------------------------------------------
 
 
    '''Steps:'''
 
 
     (a) Run as root: cd /opt/zimbra/ssl; mkdir /tmp/ssl.bak; mv * /tmp/ssl.bak
 
     (a) Run as root: cd /opt/zimbra/ssl; mkdir /tmp/ssl.bak; mv * /tmp/ssl.bak
 
     (a1) Run as root: cd /opt/zimbra/conf/ca; mkdir /tmp/ca.bak; mv * /tmp/ca.bak
 
     (a1) Run as root: cd /opt/zimbra/conf/ca; mkdir /tmp/ca.bak; mv * /tmp/ca.bak
Line 80: Line 68:
 
     ^D is Control-D
 
     ^D is Control-D
 
* Note, for zcs version 5.0.6 (e) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self
 
* Note, for zcs version 5.0.6 (e) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self
-----------------------------------------------------------------------------------------------------------------------------------
 
  
'''For Multi-Server MTA: Run this on the systems which are running postfix'''
+
====For Multi-Server MTA: Run this on the systems which are running postfix====
  
 
After doing the steps listed above on the ldap master, log into any different systems running postfix:
 
After doing the steps listed above on the ldap master, log into any different systems running postfix:
Line 94: Line 81:
 
     (f) Run as root: su - zimbra zmcontrtol start
 
     (f) Run as root: su - zimbra zmcontrtol start
  
-----------------------------------------------------------------------------------------------------------------------------------
+
====For LDAP replicas: Run this on the systems that are LDAP replicas====
 
 
'''For LDAP replicas: Run this on the systems that are LDAP replicas'''
 
  
 
After doing the steps listed above on the ldap master, log into any different systems running postfix:
 
After doing the steps listed above on the ldap master, log into any different systems running postfix:
Line 110: Line 95:
  
 
* Note, for zcs version 5.0.6 (f) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self
 
* Note, for zcs version 5.0.6 (f) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self
-----------------------------------------------------------------------------------------------------------------------------------
 
  
'''References:'''
+
==References==
  
 
http://www.zimbra.com/forums/installation/13762-solved-expired-cert-5-0ga-can-cause-mail-delivery-failure.html
 
http://www.zimbra.com/forums/installation/13762-solved-expired-cert-5-0ga-can-cause-mail-delivery-failure.html
Line 118: Line 102:
 
[ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ] - an expired CA cert will block mail delivery after upgrading to 5.0.0
 
[ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ] - an expired CA cert will block mail delivery after upgrading to 5.0.0
  
-----------------------------------------------------------------------------------------------------------------------------------
 
  
'''Issue:'''
 
  
Cannot install a Commercial Certificate in Zimbra 5.0 [Bug 23294]
+
=Issue: Cannot install a Commercial Certificate in Zimbra 5.0 [Bug 23294]=
'''
+
 
Symptom:'''
+
==Symptom==
  
 
User is unable to install a commercial certificate in Zimbra 5.0
 
User is unable to install a commercial certificate in Zimbra 5.0
'''
+
 
Common Cause:'''
+
==Common Cause==
  
 
Related to Bug [ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ]
 
Related to Bug [ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ]
  
'''Workaround:'''
+
==Workaround==
  
 
Installing Cert via Command Line: [ http://bugzilla.zimbra.com/show_bug.cgi?id=23294 ] - commercial certs fail to install
 
Installing Cert via Command Line: [ http://bugzilla.zimbra.com/show_bug.cgi?id=23294 ] - commercial certs fail to install
  
'''References:'''
+
==References==
  
 
Bug [ http://bugzilla.zimbra.com/show_bug.cgi?id=23294 ] - commercial certs fail to install
 
Bug [ http://bugzilla.zimbra.com/show_bug.cgi?id=23294 ] - commercial certs fail to install
Line 143: Line 125:
 
http://www.zimbra.com/forums/installation/13898-argh-commercial-certificates-after-4-10-5-0-foss-upgrade.html
 
http://www.zimbra.com/forums/installation/13898-argh-commercial-certificates-after-4-10-5-0-foss-upgrade.html
  
-----------------------------------------------------------------------------------------------------------------------------------
+
 
  
 
{{Article Footer|Zimbra Collaboration Suite 5.0|01/02/2008}}
 
{{Article Footer|Zimbra Collaboration Suite 5.0|01/02/2008}}
 +
 
[[Category:Troubleshooting]]
 
[[Category:Troubleshooting]]
 
[[Category:Certificates]]
 
[[Category:Certificates]]
 
[[Category:MTA]]
 
[[Category:MTA]]

Revision as of 22:28, 17 September 2008

Issue: Problem with Certificate can cause MTA Failure

Symptom

When MTA starts up, user will receive the following message in the /var/log/zimbra.log file:

Error:
  postfix/trivial-rewrite[6172]: fatal: ldap:/opt/zimbra/conf/ldap-vad.cf(0,lock|fold_fix): table lookup problem
  postfix/trivial-rewrite[19377]: fatal: ldap:/opt/zimbra/conf/ldap-vad.cf(0,lock|fold_fix): table lookup problem
  postfix/trivial-rewrite[19378]: error: dict_ldap_connect: Unable to set STARTTLS: -11: Connect error


Then the MTA (postfix) will stop functioning resulting in mail delivery failure (via lmtp and smtp).

Common Cause:

CA chain can be appended in reverse creating invalid Certificate [ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ]

The above error may also be seen when you are hitting [ http://bugzilla.zimbra.com/show_bug.cgi?id=22468 ]. In this case, the following Workaround would not work.


Workaround [5.0.1_GA or later]

For Single-server and Multi-server ldap masters

   (a) Run as root: /opt/zimbra/bin/zmcertmgr createca -new
   (b) Run as root: /opt/zimbra/bin/zmcertmgr deployca
   (c) Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self -new
   (d) Run as root: su - zimbra zmcontrol stop; su - zimbra zmcontrol start
  • Note, for zcs version 5.0.6 (c) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self

For Multi-Server: Run this on all other systems in the multi-server setup

After doing the steps listed above on the ldap master, log into any different systems running postfix:

   (a) Run as root: su - zimbra zmcontrol stop
   (b) Run as root: /opt/zimbra/bin/zmcertmgr deployca 
   (c) Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self -new
   (d) Run as root: su - zimbra zmcontrtol start
  • Note, for zcs version 5.0.6 (c) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self

Workaround [5.0.0_GA]

Read this post: http://www.zimbra.com/forums/administrators/13927-if-you-have-trouble-zimbra-5-0-read.html

Alternate: http://www.zimbra.com/forums/installation/13898-argh-commercial-certificates-after-4-10-5-0-foss-upgrade.html

   (a) Run as root: cd /opt/zimbra/ssl; mkdir /tmp/ssl.bak; mv * /tmp/ssl.bak
   (a1) Run as root: cd /opt/zimbra/conf/ca; mkdir /tmp/ca.bak; mv * /tmp/ca.bak
   (b) Run this as zimbra:
   (b1) To get the password: zmlocalconfig -s zimbra_ldap_password
   (b2) ldapmodify -x -h fqdn.server.tld -D "uid=zimbra,cn=admins,cn=zimbra" -W
   Code:
   dn: cn=config,cn=zimbra
   changetype:modify
   delete: zimbraCertAuthorityCertSelfSigned      [Hit Enter Twice here]
   ^D
   (b3) ldapmodify -x -h fqdn.server.tld -D "uid=zimbra,cn=admins,cn=zimbra" -W
   Code:
   dn: cn=config,cn=zimbra
   changetype:modify
   delete: zimbraCertAuthorityKeySelfSigned      [Hit Enter Twice here]
   ^D
   (c) as root: run /opt/zimbra/bin/zmcertmgr createca
   (d) as root: run /opt/zimbra/bin/zmcertmgr deployca
   (e) as root: run /opt/zimbra/bin/zmcertmgr install self -new
   (f) as root: su - zimbra zmcontrol stop; su - zimbra zmcontrol start
   ^D is Control-D
  • Note, for zcs version 5.0.6 (e) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self

For Multi-Server MTA: Run this on the systems which are running postfix

After doing the steps listed above on the ldap master, log into any different systems running postfix:

   (a) Run as root: su - zimbra zmcontrol stop
   (b) Run as root: cd /opt/zimbra/ssl; mkdir /tmp/ssl.bak; mv * /tmp/ssl.bak
   (c) Run as root: cd /opt/zimbra/conf/ca; mkdir /tmp/ca.bak; mv * /tmp/ca.bak
   (d) Run as root: run /opt/zimbra/bin/zmcertmgr createca
   (This will download the new CA from the LDAP server)
   (e) Run as root: run /opt/zimbra/bin/zmcertmgr deployca 
   (f) Run as root: su - zimbra zmcontrtol start

For LDAP replicas: Run this on the systems that are LDAP replicas

After doing the steps listed above on the ldap master, log into any different systems running postfix:

   (a) Run as root: su - zimbra zmcontrol stop
   (b) Run as root: cd /opt/zimbra/ssl; mkdir /tmp/ssl.bak; mv * /tmp/ssl.bak
   (c) Run as root: cd /opt/zimbra/conf/ca; mkdir /tmp/ca.bak; mv * /tmp/ca.bak
   (d) Run as root: run /opt/zimbra/bin/zmcertmgr createca
   (This will download the new CA from the LDAP server)
   (e) Run as root: /opt/zimbra/bin/zmcertmgr deployca
   (f) Run as root: /opt/zimbra/bin/zmcertmgr install self -new
   (g) Run as root: su - zimbra; zmcontrol start
  • Note, for zcs version 5.0.6 (f) should be Run as root: /opt/zimbra/bin/zmcertmgr deploycrt self

References

http://www.zimbra.com/forums/installation/13762-solved-expired-cert-5-0ga-can-cause-mail-delivery-failure.html

[ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ] - an expired CA cert will block mail delivery after upgrading to 5.0.0


Issue: Cannot install a Commercial Certificate in Zimbra 5.0 [Bug 23294]

Symptom

User is unable to install a commercial certificate in Zimbra 5.0

Common Cause

Related to Bug [ http://bugzilla.zimbra.com/show_bug.cgi?id=23253 ]

Workaround

Installing Cert via Command Line: [ http://bugzilla.zimbra.com/show_bug.cgi?id=23294 ] - commercial certs fail to install

References

Bug [ http://bugzilla.zimbra.com/show_bug.cgi?id=23294 ] - commercial certs fail to install Argh Commercial Certificates after a 4.10 -> 5.0 FOSS upgrade!

http://www.zimbra.com/forums/installation/13898-argh-commercial-certificates-after-4-10-5-0-foss-upgrade.html


Verified Against: Zimbra Collaboration Suite 5.0 Date Created: 01/02/2008
Article ID: https://wiki.zimbra.com/index.php?title=Problem_with_Certificate_can_cause_MTA_Failure Date Modified: 2008-09-17



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »

Jump to: navigation, search