[Solved] LetsEncrypt zmcertmgr verifycrt failing

[tonyg]

I just installed my first Zimbra server. Whoopee!
I feel bad about asking a question about the certs in this forum but after spending the entire day researching just this one issue I'm out of resources.

Per the wiki page for Installing a LetsEncrypt SSL Certificate, I stopped services, created .pem files, copied them to the zimbra path, and changed ownership. I also followed the section Build the proper Intermediate CA plus Root CA but I believe that section is now old and requires revision. This is important so please forgive this digression:

That section, says "To sum up: chain.pem has to be concatened with the root CA. First the chain and the end of the file the root CA. The order is important."
That's not entirely accurate. Consider this quote :

I originally wrote the code that originally creates it and the definition of fullchain.pem was cert.pem and chain.pem in a single file. The fullchain.pem file is intended for using in Nginx and Apache 2.4 (and other web servers that expect the end-entity certificate and certificate chain to be provided in a single file), while chain.pem and cert.pem are intended for Apache 2.2 (and other web servers that expect the end-entity certificate and certificate chain to be provided in separate files).

That tells us a few things:
1) If we're using Let's Encrypt, we need to use the intermediate cert, not the root cert. The intermediate cert was signed with the root cert.
2) That's especially important because the common link to IdenTrust to get the root cert doesn't work anymore. All we have is the intermediate cert.
3) With that, we don't need to download another pem file and concatenate, we just need to replace chain.pem with fullchain.pem.

All that said, that is what I did but zmcertmgr verifycrt ... fails with:

Code: Select all

** Verifying 'cert.pem' against 'privkey.pem'
Certificate 'cert.pem' and private key 'privkey.pem' match.
** Verifying 'cert.pem' against 'chain.pem'
ERROR: Unable to validate certificate chain: cert.pem: C = US, O = Let's Encrypt, CN = Let's Encrypt Authority X3
error 2 at 1 depth lookup:unable to get issuer certificate

That's a very common error. I've spent a lot of time in StackOverflow and StackExchange, and the LetsEncrypt forum, and none of the solutions there seem to apply here.
Per suggestions in this forum I'm running CentOS 7 with 4GB RAM, everything yum-updated.

I tried to verify the cert with the openssl -untrusted flag as noted here. That failed under the zimbra user but succeeded as root. Unfortunately we can't use the zmcertmgr commands as root. I don't know if it would be of value to pass that -untrusted flag to zmcertmgr deploycrt, but I don't see a way to do that, and the deploycrt operation does a verify, so I can't get around it.

Might be a factor? I'm experimenting with an existing domain. The root of this domain is hosted elsewhere. I created a DNS "A" record for a subdomain to point to an IP address for the Zimbra server, and an MX record to get to this subdomain. (BTW, I have been able to send/receive mail with this, and I'm now trying to secure it.) In the Administration web page under Domains, it shows the domain as simply 'domain.tld', not 'subdomain.domain.tld'. I generated the cert for the subdomain, I'm accessing the web pages via the subdomain, but I'm wondering if something in there is expecting the cert to be for the root domain.

Or ... Is the verification expecting specific INbound socket ports to be open? I have only opened what seems necessary. The environment is compeletely open for OUTbound requests.

So, I'm done guessing for now. I hope this is enough info for someone to see something obvious. If not, this is a new installation and I can experiment or completely scrap it if required.

Thanks for your time and insight.

[phoenix]

There's an even easier/better method of installing the LetsEncrypt certificates. Take a look at the pinned thread by JDunphy in the Administration forum, it has complete details that you need to getting it running.

You might also like to take a look at rspamd as an anti-spam replacement for ZCS, it's fairly easy to install.

Welcome to Zimbra.

[tonyg]

Thanks Bill. The solution was rather simple when I read the post by JDunphy where he said:

because I needed to allow either port 80 or 443 access to their bot for verification.

At one level I understood that inbound access was required, but one of the first instructions in the Let's Encrypt wiki page was to turn off the nginx access. As soon as I turned that on, the certs were verified and the problem solved.

I actually found the acme.sh method to be more cumbersome than the original.
- Cloning from git is the same.
- The acme method suggests loading socat just like the other method needs Perl.
- Cert modification is the same.
- Setup for automation is the same.
- The acme method says root isn't required, but I don't think anyone setting up Zimbra would not have root access.I tried using the zimbra account but had a permissions issue and had to use root for a couple steps anyway.

I don't doubt that method is helpful for some, but the original method (barring some errors in the instructions) is pretty fast and easy too.

I've requested a wiki account so that I can add some notes to the discussion pages there. This is how I intend to do my part in the pay-forward/back spirit of FOSS.

(And yes, I'll definitely be looking at all of your rspamd notes, thanks!!!)