zmcertmgr verifycrt requirement

[yeak]

The zmcertmgr will verify the SSL cert until the Root Authority level. But the usual SSL cert coming from the CA provider only has Intermedia CA, no Root CA. The Root CA is expected to be available from the OS such as in /etc/ssl/certs.

Zimbra includes its own openssl binrary, but, the /opt/zimbra/common/etc/ssl/certs is empty. What is the best way to run zmcertmgr verifycrt as Zimbra user without having to find the Root CA and append into the Intermediate CA file?

1. cd /opt/zimbra/common/etc/ssl; rmdir certs; ln -s /etc/ssl/certs
2. cp /etc/ssl/certs/* /opt/zimbra/common/etc/ssl/certs/

#1 work for Ubuntu because the hash is available inside /etc/ssl/certs. But for RHEL9, it is /etc/pki/ca-trust/extracted/pem/directory-hash (run update-ca-trust extract to generate; not available before RHEL9).

#2 Need to update it manually.

Is there a better way? I would like to automate SSL via ACME (acme.sh is nice) and the above is a challenge...

[liverpoolfcfan]

Check out JDunphy's Wiki page (and referenced zimbra.sh deployment script) https://wiki.zimbra.com/wiki/JDunphy-LE-Easy

[yeak]

Yes I actually doing that too. But it is not good enough. Appending Root CA is simply to pass the openssl verify checking. I have used ZeroSSL and Google Trust Services. They occasionally switch Root CA. Letsencrypt did that before. No matter what happen, the OS will always keep up with the correct trust ca via updates.

I wonder why /opt/zimbra/common/etc/ssl/certs is empty. It is like Zimbra didn't go extra step to integrate it to OS trust store. Or is there a post install command that we run to actually integrate it?

Also if we append the Root CA into the Intermedia CA, the deployed cert contain the entire chain. One of the security scanner pointed out I should not include self-signed Root CA into the chain. It claims this as bad practice.

[yeak]

Ok the closest I found the way is this:

RHEL based (this work in RHEL8 and RHEL9)

Code: Select all

# rm -rf /opt/zimbra/common/etc/ssl/certs/
# trust extract --format=pem-directory-hash /opt/zimbra/common/etc/ssl/certs

Ubuntu should work this way:

Code: Select all

# rm -rf /opt/zimbra/common/etc/ssl/certs/
# ln -sf /etc/ssl/certs /opt/zimbra/common/etc/ssl/certs

After this the zmcertmgr deploycrt should be straightforward.

[adrian.gibanel.btactic]

The zmcertmgr will verify the SSL cert until the Root Authority level. But the usual SSL cert coming from the CA provider only has Intermedia CA, no Root CA. The Root CA is expected to be available from the OS such as in /etc/ssl/certs.

(...)

Is there a better way? I would like to automate SSL via ACME (acme.sh is nice) and the above is a challenge...

Regarding certbot/Letsencrypt you're supposed to use the alternate root CA (Probably ISRG Root) which it's supported by default by Zimbra. It's just adding a switch when creating the certbot request.

In the worst case scenario you should be adding the non alternate root CA to Zimbra keystore: https://wiki.zimbra.com/wiki/Adding_external_CA_to_Zimbra_keystore instead of messing up with /opt/zimbra/common/etc/ssl/certs contents.