Skip to content

Certificates (SSL/TLS)

Monitor your servers' web, mail and proxy certificates on one screen; install self-signed or commercial certificates, generate CSRs and define a separate certificate for each domain.

Global administratorAdmin console › Tools and Migration › Certificates

Status dashboard

  1. Click Tools and Migration › Certificates in the left tree. The page opens immediately; wait a few seconds while the list is read from the servers.
  2. The cards at the top show the number of certificates that are Total, Valid, Expiring (30d) and Expired. The table below lists, for each server, the subject, issuer, expiry date and status of the ldap, mailboxd, mta and proxy certificates.

The Certificates screen: counter cards and certificate list

The Certificates screen: counter cards and certificate list

Installing a commercial or wildcard certificate

Each component is tested separately before installation; if there is an error, the OK button stays disabled.

  1. Click Import wildcard SSL. The Install certificate window opens with Action: Commercial / import wildcard selected.
  2. Fill in Certificate PEM (it can be the bundle your CA sent), Private key PEM and CA chain PEM.
  3. Press Test. The Test result is listed under four headings as OK / Warning / Error:
    • Certificate: readable, its dates, whether the name is in the SAN.
    • Private key: its format and whether it matches the certificate.
    • CA chain: order (leaf → intermediate → root) and dates.
    • Server check: verification on the server with zmcertmgr.
  4. If there is no Error, press OK. The certificate is installed and the list refreshes.
  5. For the services to use the new certificate, run zmcontrol restart as the zimbra user on the server.

The install window: PEM fields, Test and OK

The install window: PEM fields, Test and OK

Bundles and key formats

You can paste the leaf, intermediate and root certificates into the certificate field in any order; the chain is ordered automatically. RSA or EC keys (PKCS#1, PKCS#8, SEC1) are read. Remove the password from a protected key first: openssl pkey -in key.pem -out key-open.pem.

If the key was generated on another machine

Zimbra uses the key on disk during installation. In this case the test shows a Warning; when you tick Upload the key to the server, the key is written to the server (the previous file is backed up) and the installation runs.

Generating a CSR

Click Install / CSR and choose Generate CSR only as the Action; fill in CN and Subject Alt Names and press OK. Send the generated PEM text to your certificate provider. Install the certificate from your CA with the steps above.

Self-signed certificate

For test environments, choose Self-signed as the Action in the Install / CSR window and fill in CN and Subject Alt Names. Browsers warn about this certificate; use a commercial certificate in production.

A separate certificate for each domain

If you host several domains, each domain can serve its own certificate on its own address (for example zpe.profelis.net). The browser announces the name it wants when connecting (SNI); the proxy serves that name's domain certificate. Addresses without a domain certificate keep using the server certificate.

How a domain certificate goes live How a domain certificate goes live 1 Admin console Domain certificate: domain, virtual host, certificate + key 2 Domain entry Certificate and key are stored on the domain 3 Proxy server zmdomaincertmgr deploycrts and zmproxyctl restart 4 Browser zpe.profelis.net gets the domain's own certificate
  1. Click Domain cert. The Domain certificate window shows the selected domain's Current certificate.
  2. Choose the domain in the Domain list and enter the name users connect to in Virtual hostname (for example mail.zpe.profelis.net). If the domain already has a name, the field is filled in.
  3. Paste Certificate PEM, Private key PEM and CA chain PEM.
  4. Press OK. Before saving, these are checked; if any fails, nothing is saved:
    • the key belongs to the certificate,
    • no intermediate certificate is missing,
    • the certificate covers the virtual hostname (SAN; otherwise CN; *.domain is valid),
    • it has not expired.

The Domain certificate window

The Domain certificate window

The certificate is saved on the domain itself. If the virtual hostname is not on the domain it is added; existing names are kept. Then activate it on each proxy server as the zimbra user and repeat the steps for the other domains:

/opt/zimbra/libexec/zmdomaincertmgr deploycrts
zmproxyctl restart

Check: openssl s_client -connect <proxy>:443 -servername zpe.profelis.net </dev/null | openssl x509 -noout -subject -enddate

Prerequisites

Each virtual hostname's DNS record must point to the proxy and zimbraReverseProxySNIEnabled must be TRUE (the default). The domain certificate's key is independent of the server CSR.

Troubleshooting

Symptom Cause and solution
unknown document for GetCertRequest The Zimbra certificate manager component is not installed.
unknown document for PfCertVerifyRequest The Profelis certificate extension is not loaded or mailboxd was not restarted; the zimlet uses the stock path and an external key cannot be uploaded.
Installation stops at deploycrt The key on disk is not the one you pasted. As the zimbra user run zmcertmgr deploycrt comm and zmcontrol restart; the certificate and key are taken from LDAP.