Zimbra SSL Let's Encrypt

Default SSL in zimbra is unsecure, and got red in browser access because not valid, in this article we want to configure valid SSL for Zimbra.

We using let's encrypt for free ssl certificate

Run on mail1

export variable for easy configuration

export EMAIL="[email protected]"
export ZIMBRA_FQDN=$(hostname -f)

certbot certonly --standalone \
  -d $ZIMBRA_FQDN \
  --force-renewal \
  --preferred-challenges http \
  --agree-tos \
  -m $EMAIL

You can change certbot challenges with DNS and other verification method.

After successed get certificate copy privkey to commercial.key in zimbra

cp /etc/letsencrypt/live/$ZIMBRA_FQDN/privkey.pem /opt/zimbra/ssl/zimbra/commercial/commercial.key

Change owner of privkey

chown zimbra:zimbra /opt/zimbra/ssl/zimbra/commercial/commercial.key

Create CA Let's encrypt

wget -O /tmp/ISRG-X1.pem https://letsencrypt.org/certs/isrgrootx1.pem
wget -O /tmp/R3.pem https://letsencrypt.org/certs/lets-encrypt-r3.pem
cat /tmp/R3.pem > /etc/letsencrypt/live/$ZIMBRA_FQDN/chain.pem
cat /tmp/ISRG-X1.pem >> /etc/letsencrypt/live/$ZIMBRA_FQDN/chain.pem

Change owner directory /etc/letsencrypt to zimbra user

chown -R zimbra:zimbra /etc/letsencrypt

Verify Let's encrypt certificate

su - zimbra
export ZIMBRA_FQDN=$(hostname -f)
/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /etc/letsencrypt/live/$ZIMBRA_FQDN/cert.pem /etc/letsencrypt/live/$ZIMBRA_FQDN/chain.pem

If all are valid, it will appear as follows, and you can proceed to deploy SSL

** Verifying '/etc/letsencrypt/live/mail.dosys.my.id/cert.pem' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
Certificate '/etc/letsencrypt/live/mail.dosys.my.id/cert.pem' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.
** Verifying '/etc/letsencrypt/live/mail.dosys.my.id/cert.pem' against '/etc/letsencrypt/live/mail.dosys.my.id/chain.pem'
Valid certificate chain: /etc/letsencrypt/live/mail.dosys.my.id/cert.pem: OK

Deploy Certificate

/opt/zimbra/bin/zmcertmgr deploycrt comm /etc/letsencrypt/live/$ZIMBRA_FQDN/cert.pem /etc/letsencrypt/live/$ZIMBRA_FQDN/chain.pem

Restart Zimbra

zmcontrol restart

Access Zimbra Dashboard

Check certificate detail