Installing a SSL certificate on Zimbra

Once an SSL order with the CSR code is activated and all validation requirements are met, the SSL certificate will be issued and sent to your administrative contact email address. You can also download the SSL certificate in your Namecheap account. When the SSL certificate is received, you are welcome to start the installation process.

Zimbra mail server supports two possible ways of SSL installation:

  • zimbra administration console (web interface)
  • zimbra certificate manager (command line interface).

SSL certificate installation via Zimbra Administration Console

  1. Click on “Configure” from the left list of the main menu:
  2. instzim1

  3. In the next window, click on “Certificates” and pick the option “Install Certificate”:
  4. instzim2

  5. You will see a separate window where you need to choose the required mail server. Click “Next” afterwards:
  6. instzim3

  7. Pick “Install the commercially signed certificate” option to start the installation process:
  8. instzim4

  9. Review all information that was used for CSR generation. If the information is correct, click on the “Next” button:
  10. instzim5

  11. Upload the SSL certificate file, root certificate and intermediate certificates received from the Certificate Authority. If intermediate and root certificates were received in one bundled file, you can download them separately: for RSA certificate and for ECC certificate.

    instzim6

  12. On the next step, click “Install” to install the chosen SSL certificate. The installation process can take a few minutes:
  13. instzim7

  14. When the SSL installation process is completed, you will see the notification:
  15. instzim8

  16. To apply changes, you need to restart Zimbra services like zimbra user in a CLI session:
  17. sudo su
    su zimbra

    Once the default user is switched to the zimbra user, run this command to restart services:

    zmcontrol restart

  18. When all services are restarted, new SSL certificate details can checked here:
  19. instzim9

The SSL certificate has been successfully installed for the following services:

LDAP service: port 389
Mailbox service: ports 8443, 7071
MTA service: ports 25 (SMTP TLS), 465 (SMTP SSL), 7110 (POP3 TLS), 7143 (IMAP TLS), 7993 (IMAP SSL), 7995 (POP3 SSL)
Proxy service: 443, 110 (POP3 TLS), 143 (IMAP TLS), 993 (IMAP SSL), 995 (POP3 SSL).

instzim10

It is possible to check SSL installation by using this online tool: https://decoder.link/sslchecker/.

SSL certificate installation via Zimbra Certificate Manager (command line interface)

A Zimbra package has the “zmcertmgr” tool to manage SSL certificates.
For version 8.6 or lower, this tool must be run as root. Run this command in the terminal to switch from the default user to the root:

sudo su

Starting from version 8.7 this tool should be run as zimbra user.
Run these commands to switch from the default user to the zimbra user:

sudo su
su zimbra

  1. To start the installation process, you need to upload the SSL certificate file (server_domain_com.crt) and CA bundle file (server_domain_com.ca-bundle) to any folder to your hosting server on the temporary basis. For this example, SSL files have been uploaded to the /opt/ directory.
  2. Verify that your certificate received from the Certificate Authority matches the private key generated along with the CSR: /opt/zimbra/bin/zmcertmgr verifycrt comm
    /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/server_domain_com.crt /opt/server_domain_com.ca-bundle
  3. The output should look like:

    instzim11

  4. Deploy your commercial certificate.
    /opt/zimbra/bin/zmcertmgr deploycrt comm /opt/server_domain_com.crt /opt/server_domain_com.ca-bundle
  5. The successful output should look like:

    instzim12

  6. Verify that the correct certificate has been deployed.
    /opt/zimbra/bin/zmcertmgr viewdeployedcrt
  7. For example, the details of the PositiveSSL certificate will look like:

    instzim13

  8. To apply changes, you need to restart Zimbra services like zimbra user:

sudo su
su zimbra

Once the default user is switched to zimbra user, run this command to restart services:

zmcontrol restart

When all services are restarted, new SSL certificate details can checked by using this online tool: https://decoder.link/sslchecker/.

How to deploy a Multi-Domain SSL certificate or SSL Wildcard certificate installed on another hosting server for Zimbra?

  1. Copy the SSL certificate file (server_domain_com.crt), CA bundle file (server_domain_com.ca-bundle) and private key (commercial.key) to any folder of your hosting server on the temporary basis. For this example, SSL files have been uploaded to the /opt/ directory.
  2. Copy the private key from the temporary location to the default folder of commercial certificates.
  3. cp /opt/commercial.key /opt/zimbra/ssl/zimbra/commercial/

  4. Set default permissions for the private key.
  5. chmod 640 /opt/zimbra/ssl/zimbra/commercial/commercial.key

  6. Verify that your certificate received from the Certificate Authority matches the private key
  7. /opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/server_domain_com.crt /opt/server_domain_com.ca-bundle

    The output should look like:

    instzim11

  8. Deploy your commercial certificate.
  9. /opt/zimbra/bin/zmcertmgr deploycrt comm /opt/server_domain_com.crt /opt/server_domain_com.ca-bundle

    The successful output should look like:

    instzim12

  10. Verify that the correct certificate has been deployed.
  11. /opt/zimbra/bin/zmcertmgr viewdeployedcrt

    For example, the details of the PositiveSSL certificate will look like:

    instzim13

  12. To apply changes, you need to restart Zimbra services like zimbra user in the terminal:

sudo su
su zimbra

Once the default user is switched to zimbra user, run this command to restart services:

zmcontrol restart

When all services are restarted, new SSL certificate details can checked by using this online tool: https://decoder.link/sslchecker/.

Comments

We welcome your comments, questions, corrections and additional information relating to this article. Your comments may take some time to appear. Please be aware that off-topic comments will be deleted.

If you need specific help with your account, feel free to contact our Support Team. Thank you.

Need help? We're always here for you.

× Close