Howto: GoDaddy UCC cert renewal

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
ewilen
Elite member
Elite member
Posts: 1429
Joined: Fri Sep 12, 2014 11:34 pm

Howto: GoDaddy UCC cert renewal

Postby ewilen » Sat Jun 05, 2010 10:27 pm

A lot of people seem to have trouble with GoDaddy certs, especially when renewing. I did, too--tried to use the Admin GUI, fail. Looked through the forums and tried a few things others suggested, without luck. Finally I combined two ideas I'd seen on the forum and it was easy as pie. So I thought I'd share.
It's all done through the CLI. ZCS in this case is 6.0.6.1.
Step 1: Generate CSR as root.
# /opt/zimbra/bin/zmcertmgr createcsr comm -new -keysize 2048 "/C=$country/ST=$state/L=$city/O=$organization/OU=$unit/CN=$FQDN1/CN=$FQDN2"
The $items are for you to fill in, without the dollar signs of course. In this case I had an organizational unit (OU). If you don't have one, leave out the "/OU=$unit". Also the first $FQDN1 is the primary name on the cert; any Subject Alternative Name(s) go in the second $FQDN2 (and any subsequent ones).
The output should look something like this:

** Generating a server csr for download comm -new -keysize 2048 /C=$country/ST=$state/L=$city/O=$organization/OU=$unit/CN=zimbra.company.com/CN=zimbra.company2.com

** Creating /opt/zimbra/conf/zmssl.cnf...done

** Backup /opt/zimbra/ssl/zimbra to /opt/zimbra/ssl/zimbra.20100605164109

** Creating server cert request /opt/zimbra/ssl/zimbra/commercial/commercial.csr...done.

** Saving server config key zimbraSSLPrivateKey...done.

If all goes well, the CSR will be in opt/zimbra/ssl/zimbra/commercial/commercial.csr
Step 2: Submit CSR to GoDaddy and download the cert.
# cat /opt/zimbra/ssl/zimbra/commercial/commercial.csr
Copy & paste the output into the GoDaddy form. For server type, use "Other". Then download the cert zipfile, unzip it, and put the contents somewhere on your zimbra server. E.g. we'll assume they're in /root/certs/ and that the site cert is called zimbra.company.com.crt. The only other cert in the zip is gd_bundle.crt. (I haven't found any need for GoDaddy's intermediate cert bundle, which is apparently included in the downloads for certain servers.)
Step 3: Verify the cert chain.
cd /root/certs/

# /opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key ./zimbra.company.com.crt ./gd_bundle.crt

The output should be
** Verifying ./zimbra.company.com.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key

Certificate (./zimbra.company.com.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.

Valid Certificate: ./zimbra.company.com.crt: OK

Step 4: Install the cert
# /opt/zimbra/bin/zmcertmgr deploycrt comm ./zimbra.company.com.crt ./gd_bundle.crt
And the output
** Verifying ./zimbra.company.com.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key

Certificate (./zimbra.company.com.crt) and private key (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.

Valid Certificate: ./zimbra.company.com.crt: OK

** Copying ./zimbra.company.com.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt

** Appending ca chain ./gd_bundle.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt

** Saving server config key zimbraSSLCertificate...done.

** Saving server config key zimbraSSLPrivateKey...done.

** Installing mta certificate and key...done.

** Installing slapd certificate and key...done.

** Installing proxy certificate and key...done.

** Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12...done.

** Creating keystore file /opt/zimbra/mailboxd/etc/keystore...done.

** Installing CA to /opt/zimbra/conf/ca...done.

Step 4: Check the cert.
I didn't want to reboot the whole server right away, so I just did

# su zimbra

# zmmailboxdctl restart

Once mailboxd had restarted, I opened the login page with a web browser and inspected the certificate.
Since I'm not sure if other services (such as mta) need to load the cert independently, I scheduled a full restart (zmcontrol stop && zmcontrol start) for later, after notifying the users.
(Here's where I found the answers: http://www.zimbra.com/forums/installation/34353-manual-certificate-installation-godaddy-2048-requirement.html#post175034 and http://www.zimbra.com/forums/administrators/38607-solved-renew-godaddy-ssl-cert.html#post176902.)


10424bofh
Outstanding Member
Outstanding Member
Posts: 286
Joined: Sat Sep 13, 2014 1:15 am

Howto: GoDaddy UCC cert renewal

Postby 10424bofh » Sun Jul 11, 2010 6:06 am

thanks ewilen. very helpfull, works like charm

to bad that teh gui dont have those options..
Maja
Posts: 30
Joined: Fri Sep 12, 2014 10:07 pm

Howto: GoDaddy UCC cert renewal

Postby Maja » Fri Aug 27, 2010 3:27 pm

Worked like a charm. Thanks for the steps.
MyBrooklyn
Posts: 6
Joined: Sat Sep 13, 2014 12:55 am

Howto: GoDaddy UCC cert renewal

Postby MyBrooklyn » Sun Mar 04, 2012 10:17 pm

@ Elliot Wilen...Thank you so much for your step by step intructions on how to generate a CSR code and installing a certificate from GoDaddy provider.
Release 6.0.5_GA_2213.UBUNTU8 UBUNTU8 FOSS edition.
warmbowski
Posts: 36
Joined: Fri Sep 12, 2014 11:28 pm

Howto: GoDaddy UCC cert renewal

Postby warmbowski » Wed Apr 11, 2012 3:31 pm

Much thanks for the recipe. Made my day.
ferra
Advanced member
Advanced member
Posts: 106
Joined: Fri Sep 12, 2014 10:47 pm

Howto: GoDaddy UCC cert renewal

Postby ferra » Thu Apr 12, 2012 9:00 am

I'm running Release 6.0.2_GA_1912.F7_20091020145320 F7 FOSS edition.

Try to install a new godaddy certificate without success. I follow this steps but still the same error:

"zmcontrol start

Host server_name.FQDN

Starting ldap...Done.

Unable to determine enabled services from ldap.

Enabled services read from cache. Service list may be inaccurate.

Starting logger...Failed.

Starting logswatch...ERROR: service.FAILURE (system failure: ZimbraLdapContext) (cause: javax.net.ssl.SSLHandshakeException sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target)

zimbra logger service is not enabled! failed."
The only difference was that I created the csr file from the GUI, should I create the CSR file from the command line?
Thanks
ferra
Advanced member
Advanced member
Posts: 106
Joined: Fri Sep 12, 2014 10:47 pm

Howto: GoDaddy UCC cert renewal

Postby ferra » Fri Apr 13, 2012 9:50 am

gave up, I cannot install the certificate. The only difference, I can note, is instead of zimbra.company.com.crt I get company.com.crt
Everything is OK until I restart the server.
davidv
Posts: 3
Joined: Fri Sep 12, 2014 11:23 pm

Howto: GoDaddy UCC cert renewal

Postby davidv » Fri Dec 28, 2012 8:11 am

Thank you for this howto Elliot!

It worked flawlessly for me on single-node ZCS 8.0.2, with alias domains, with a GoDaddy UCC certificate.

:)

david
MyBrooklyn
Posts: 6
Joined: Sat Sep 13, 2014 12:55 am

Howto: GoDaddy UCC cert renewal

Postby MyBrooklyn » Fri Dec 28, 2012 11:22 am

@ ferra ....Hello ferra.....get in touch with me if you still need help generating certificate and installing godaddy cert on your Zimbra server. Let’s try troubleshoot it together.....i followed Elliot Wilen step by step instructions after a few tries it was not successful because of my own errors but once I sat down without any distraction I was able to accomplish my goal. Again Elliot Wilen thank you for your help to the Zimbra community users. BTW I am running my Zimbra Mail Server on Ubuntu 10 64Bit Server

Return to “Administrators”

Who is online

Users browsing this forum: No registered users and 7 guests