Blog Support

Zimbra Mail Server SSL Configuration and Installation Guide

Zimbra Collaboration, formerly known as the Zimbra Collaboration Suite before 2019, is a collaborative software suite that includes an email server and a web client. It is a dedicated server that manages all of the mailbox contents, including messages, contacts, calendar, and attachments. Messages are received from the Zimbra MTA server and then passed through any filters that have been created. Messages are then indexed and deposited into the correct mailbox. This written guide will show you how you can secure your Zimbra mail server by successfully installing an SSL Certificate.

Zimbra Mail Server SSL Installation Video Guide
Play Video

Zimbra Mail Server SSL Installation Video Guide

Step 1. Generating a CSR and Private Key

1: Head over to yourdomain.com:7071 and login to your Zimbra Mail Server's Admin Portal

2: In the main menu, click on Configure.

zimbra-configure-button

3: Select Certificates and then click on the gear icon on the top right (next to Help) and select Install Certificate.

zimbra-install-cert-button

4: Select your Target Server and click on Next

zimbra-select-target-server

5: Choose the Generate CSR option and click on Next.

zimbra-generate-csr-option

6: Fill in the CSR Details as specified below:-

zimbra-csr-details

Country Name (2 letter code) [AU]: Type in the 2 letter abbreviation for your country.
State or Province Name (full name) [Some-State]: Full name of the state
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Locality Name (eg, city) []: Complete name of the city, no abbreviations
Organization Name (eg, company) [Internet Widgits Pty Ltd]: If you are a business; Enter your legal entity name. If you're not a business, any value entered will not be used in your certificate.
Organizational Unit Name (eg, section) []: If you are a business; Write the appropriate division of your company. It is best to use something generic such as "IT".
Common Name (e.g. server FQDN or YOUR name) []: Enter your domain name
Email Address []: Enter your email address

Now, select the required root length and click on Next to generate your CSR.

You will now see your newly generated Private Key and CSR. Make sure to store both in a safe location as you will need them for further SSL Configuration.

Step 2. Order and Configure the SSL Certificate

Now, we need to order an SSL Certificate. If you visit our SSL Certificates List page, you will see options available, such as a low-cost domain-validated SSL or a wildcard SSL, which also secures the sub-domains.

Cheap SSL Certificates

View our low cost SSL Certificates with domain validation.

Starting at $ per year

Wildcard SSL

View our Wildcard Certificates to Secure Unlimited Sub-domains.

Starting at $ per year

Business Certificates

View our Business Certificates to secure and verify your business.

Starting at $ per year

If you require any assistance with selecting an SSL Certificate, please feel free to contact our sales team and they will be happy to assist.

1: Order the SSL and complete the checkout.

2: Once you have completed the SSL Certificate Purchase you can begin the configuration process. This can be started by going into your SSLTrust account and managing your recent purchase.

manage ssl

You then will need to click the Submit Configuration button to begin the configuration process.

submit ssl configuration

3: You now need to paste in the CSR you generated using the OpenSSL library in the Ubuntu CLI. This includes the lines:

text

-----BEGIN CERTIFICATE REQUEST----
-----END CERTIFICATE REQUEST-----
configure SSL

Select Other for your Web Server Type.

ssl admin details

You will need to also enter the Site Administrator Contact Information.

This information is to be of the individual who is responsible to approve and SSL Certificate. If it is a business SSL, it needs to be a contact under the business.

The Technical Contact Information is the details of the individual responsible for the installation and management of the Certificate.
If you have ordered a business SSL, you will also be required to enter your business details. These should be the correct address and phone number and legal entity name. They will be required to be validated by the Certificate Authority, any mistakes will cause delays. More information on Business Validation can be found here.

4: Click Continue to go to the next Step. Here you need to select the Authentication Method to validate your domain name. This is required to prove you own the domain name and have permission to issue an SSL Certificate for the domain.

select domain validation method

Select the method that will be the easiest for you to use; File-Based Authentication ( HTTP / HTTPS ), CNAME Based Authentication ( DNS ) or Certificate Approver Email.

If you have access to one of the listed emails, this can be the quickest method

Click Continue/Submit to finish the Configuration process.

After you complete the domain validation via your selected method, your SSL will be issued. If you ordered a Business SSL, you will need to wait for the Certificate Authority to complete the Business address and phone validation. If the validation has not progressed, or you have not received your Certificate after some time, please contact our support team so we can check on its status.

sectigo validation manager

Step 3: Select the Target Server & Install the SSL Certificate

When your SSL Certificate has been issued, you will be emailed the Certificate Directly from the Certificate Authority. You can also download it from your SSLTrust Portal. Downloading it from the SSLTrust Portal is a good option as we format the certificate in an easy to use way.

Again; View your certificate management page within SSLTrust

manage ssl

1: Click on the Manage button and collect/download your certificate.

download ssl button

2: Select the format as individual files with either a .pem or .cer extension and click on Download Certificate.

ssl-extension

3: Go back to the Zimbra SSL Installation dialog box and again choose the Installation option as Install the commercially signed certificate

zimbra-commercial-certificate

4: Review the CSR which you generated and click on Next.

zimbra-review-csr

5: Upload the certificate files to your server and click on Install

zimbra-upload-certificates



Note:- If you get this error (error : system failure: exception executing command: zmcertmgr verifycrtchain).
This means that Zimbra was not able to automatically verify and deploy your certificates and you will have to do it manually.

To get rid of this error, simply execute the following steps:-

1: Create a certificate chain:-

You can do this 2 ways:-

a: Copy and paste the main certificate file, the intermediate files and the root certificate into one file and upload it to your server.

OR

b: Run the following command.

shell

cat path-to-certificate.crt path-to-intermediate-certificate/s.crt path-to-root-certificate.crt > path-to-chain-certificate.crt

Make sure to replace the command with appropriate paths. You can set a new output directory as a path for the chain certificate.

2: Verify the certificates:

shell

/opt/zimbra/bin/zmcertmgr verifycrt comm path-to-private-key.key path-to-certificate.crt path-to-certificate-chain.crt

Generally, the command should look like this-

/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/ca_chain.crt

3: Deploy the Certificates

shell

/opt/zimbra/bin/zmcertmgr deploycrt comm path-to-certificate.crt path-to-certificate-chain.crt

4: To finish, verify the certificate was deployed.

shell

/opt/zimbra/bin/zmcertmgr viewdeployedcrt



Step 4: Restart your Server via the CLI

Once you've successfully uploaded the certificate files to your server and installed the certificate, it is now time to restart the server. To do so,
you will have to get root access to your server via SSH and execute the following commands:-

shell

sudo su
su zimbra
zmcontrol restart

That is it, you have successfully installed an SSL Certificate on your Zimbra Mail Server.

Step 5. Check the SSL is working

SSLTrust's Free SSL Checker is a tool that allows you to test and validate the SSL/TLS certificates installed on websites. Simply enter a domain name and it will analyze the certificate, providing details like the issuer, expiration date, encryption strength, and whether the certificate is properly configured and trusted by major browsers and operating systems. In SSL tests, receiving an "A" rating typically signifies that the SSL certificate and its configuration meet high security standards.

SSLTrust Free SSL Checker A Rating

The checker highlights any potential security issues or misconfigurations with the SSL implementation. This free tool makes it easy to verify if a website's SSL certificate is valid and secure, giving visitors confidence their connection is encrypted and their data is protected from eavesdroppers.

SSLTrust Free SSL Checker Detailed Report Example Drop Down

Additionally, you can also performed a detailed check which generates an actionable report with all the ins and out of your SSL Certificate. This includes Protocols, Ciphers, Vulnerabilities and much more.

SSLTrust Free SSL Checker Detailed Report

-

You might require assistance from your web developer or make the necessary updates to your website personally to ensure that all files utilize "https://" and all links leading to and within your website employ "https://".


Further Configuration

1: Turn of older versions of TLS:-

shell

su zimbra
zmprov mcf -zimbraReverseProxySSLProtocols TLSv1
zmprov mcf -zimbraReverseProxySSLProtocols TLSv1.1
zmcontrol restart

Discussions and Comments

Click here to view and join in on any discussions and comments on this article.

Written by
Siddiqui Ammar


Helpful Guides

View more Guides, FAQs and information to help with your Certificate purchases.

Learning Centre

View more resources on cyber security, encryption and the internet.


Continue reading with these guides you may be interested in...

#SSL/TLS

VestaCP SSL Configuration and Installation Guide

Video Included

Vesta Control Panel or Vesta CP- powered by Softaculous is an open source hosting control panel, which can be used to manage multiple websites, create and manage email accounts, FTP accounts, and MySQL databases, manage DNS records and much more. …

#SSL/TLS

Apache on Ubuntu SSL Installation Guide

Video Included

Apache is the most widely used web server in the world, powering more than 60% of all active websites on ther internet. It is an open-source software available for free which anybody can use to serve static or dynamic sites to userts. Ubuntu is an …

#SSL/TLS

Apache on Debian SSL Installation Guide

Video Included

Apache is the most widely used web server in the world, powering more than 60% of all active websites on ther internet. It is an open-source software available for free which anybody can use to serve static or dynamic sites to userts. Debian, also …

#SSL/TLS

DirectAdmin SSL Configuration and Installation Guide

Video Included

DirectAdmin is a powerful web hosting control panel that simplifies server management for both administrators and end-users. Offering an intuitive interface, it allows users to effortlessly manage websites, emails, databases, and more. With features …