Upgrade from 8.6 to 8.7.11 - java.security.cert.CertificateException with CACERT certificate

[keynet]

Hi,

Long time user of Zimbra, just upgraded from 8.6 to 8.7.11.
All seems OK after following instructions here https://wiki.zimbra.com/wiki/Zimbra_Rel ... .0/Upgrade.

I've been using a CACERT certificate for several years, and it works in 8.7.11 (admin console and end-user), however I cannot use zmprov CLI when this certificate is deployed.
As user Zimbra. when I type just zmprov, I get:

Code: Select all

ERROR: zclient.IO_ERROR (invoke java.security.cert.CertificateException: Certificates does not conform to algorithm constraints, server: localhost) (cause: javax.net.ssl.SSLHandshakeException java.security.cert.CertificateException: Certificates does not conform to algorithm constraints)

This of course means I can't do some critical configurations
Steps I have tried:
- deploying a self-signed cert - yes all OK, I can use use zmprov again
- Redeploying the CACERT cert - same problem, and no errors when deploying
- Checks - appears listed in in Admin console OK
- openssl x509 -text -noout -in /opt/zimbra/ssl/zimbra/commercial/commercial.crt - gives what you would expect.
- I checked openssl s_client -showcerts -connect localhost:443, get the same as the old 8.60 install

The only hints I can find on the Net relate to obsolete certificate signing, but this reports sha512WithRSAEncryption

Appreciate any help, thanks

[lytledd]

Code: Select all

ERROR: zclient.IO_ERROR (invoke java.security.cert.CertificateException: Certificates does not conform to algorithm constraints, server: localhost) (cause: javax.net.ssl.SSLHandshakeException java.security.cert.CertificateException: Certificates does not conform to algorithm constraints)

Not 100% sure, but it looks like the certificate in question has been created with a cipher that is no longer supported in 8.7.11.

Doug

[keynet]

Thanks for your reply.

In the end I gave up on that upgrade, reverted to my 8.6.0 backup container, re-did the upgrade procedure in a different order, this time it's OK.

For the benefit of others, I think I may have mistakenly done the proxy cipher upgrade before the main upgrade procedure, though I wouldn't have expected that to affect zmprov (these were the steps: https://wiki.zimbra.com/wiki/Zimbra_Rel ... .0/Upgrade "Update Default Proxy SSL Ciphers Attribute")

This time I did only the minimum prep before upgrade of making sure the proxy/memcached were installed (originally not), and fixing the LDAP root password per https://wiki.zimbra.com/wiki/Upgrade_Sc ... figuration (dated 2008, and not working), before completing "Single Server Upgrade Steps".