Zimbra 7 stop working if SSL certificate is expired

SOLVED: Zimbra 6.0.1 stop working if SSL certificate is expired
http://www.zimbra.com/forums/administrators/44241-solved-solved-zimbra-6-0-1-stop-working-if-ssl-certificate-expired.html

Entrar con putty o con Vshpere Client a la consola de RedHAT, ingresar como root y el password correspondiente

Para ver la fecha de expiración de tus certificados:
[root@mail ~]# /opt/zimbra/bin/zmcertmgr viewdeployedcrt

Primero que todo revisa la hora y la fecha del servidor para que sea la apropiada, si no es correcta corríjela con el comando:

[root@mail ~]# date
Thu Feb 9 16:06:09 ECT 2012

The date command also can be used to set the time and date. To set the time manually, do this:

# date -s "16:15:00"
Fri Mar 28 16:15:00 CST 2003

If you also need to adjust the date, and not just the time, you can do it like this:
# date -s "16:55:30 July 7, 1986"
Mon Jul 7 16:55:30 PDT 1986

There is also another way to set the date and time, which is not very pretty:
# date 033121422003.55
Mon Mar 31 21:42:55 PST 2003

The above command does not use the -s option, and the fields are arranged like this: MMDDhhmmCCYY.ss
where MM = month, DD = day, hh = hour, mm = minute, CCYY = 4 digit year, and ss = seconds.


Si tu fecha y hora es correcta tienes un problema de la CA (Certification Authority)y los certificados de los servicios expirados

Pasos para la versión 7:

- El mensaje exacto del error se presenta después de intentar iniciar el servicio

[root@mail ~]# su -- zimbra
[zimbra@mail /]$ zmcontrol start
Starting ldap ... Done.
Unable to determine enabled services for ldap. Enabled services read from cache. Service List may be inaccurate.
Starting zmconfigd ... Done.
Starting logger ... Failed
Starting logswatch...ERROR: service failure (system failure: ZimbraLdapContext) (cause: javax.net.ssl.SSLHandshakeException sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed)
zimbra logger service is not enabled! failed.

Starting mailbox...Done.
Starting antispam...Done.
Starting antivirus...Done.
Starting mta...Done.
Starting stats...Done.

[zimbra@mail /]$ exit
Saca un Backup antes de intentar este procedimiento



[root@mail ~]# /opt/zimbra/bin/zmcertmgr createca -new
[root@mail ~]# /opt/zimbra/bin/zmcertmgr createcrt -new -days 365
[root@mail ~]# /opt/zimbra/bin/zmcertmgr deploycrt self
[root@mail ~]# /opt/zimbra/bin/zmcertmgr deployca
[root@mail ~]# /opt/zimbra/bin/zmcertmgr viewdeployedcrt
[root@mail ~]# /opt/zimbra/java/bin/keytool -delete -alias root -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit
[root@mail ~]# /opt/zimbra/java/bin/keytool -import -alias root -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit -file /opt/zimbra/conf/ca/ca.pem

Aquí yo recomiendo reiniciar, caso contrario
[root@mail ~]# su -- zimbra
[zimbra@mail /]$ zmcontrol start

Saludos

BADBOY

ZCS Avoiding Browser (IE, Firefox, Outlook) Certificate Error with Zimbra Web Client

1. on Zimbra with Putty or Terminal run:

openssl x509 -in /opt/zimbra/ssl/zimbra/ca/ca.pem -outform DER -out /var/tmp/ca.cer

2. startx
3. browse to https://mail.tudominio.com/
4. attach and sent your self the the ca.cer file from /var/tmp

Use GPEDIT.MSC (workgroup) or GPO to copy certificates to other domain machines
1. Ve a Policy Object Name/Computer Configuration/Windows Settings/Security Settings/Public Key Policies/Trusted Root Certification Authorities
2. Right clic and click on import
3. Select ca.cer downloaded after.
4. close GPO or GPEDIT.MSC
5. Reboot

Voilá, mensaje de error de certificado CHAO!!!









06-25-2009, 07:59 AM





Source: http://www.zimbra.com/forums/administrators/26641-outlook-users-getting-certificate-warning.html

YetiRick
New Member

Posts: 4

I know this is too late to help any of the old posters, but it may help other with the same question...

Assuming the Zimbra devs don't move the file, the command:

openssl x509 -in /opt/zimbra/ssl/zimbra/ca/ca.pem -outform DER -out ca.der

will generate the CA root certificate you need in order for Windows to import it properly. You can then copy the resulting ca.der file to your Windows box and double-click it (or import it using the wizard.) It will install into the "Trusted Root Certification Authorities" section of your certificates window. Outlook and HTTPS webmail will no longer generate those annoying errors.

Please keep in mind that if the Zimbra CA is pre-generated and not generated at the time of installation, this will open you up to misidentified sites that sign their own certs with the same CA. I don't know if this is the case or not, but would recommend building your own CA if you're unsure.

[SOLVED] Rolling Your Own CA and Installing Certificates in Zimbra

will get that done for you. And you won't have to guess at which ca.pem file to use.


Fuente 2: http://technet.microsoft.com/en-us/library/cc738131(WS.10).aspx
Add a trusted root certification authority to a Group Policy object
Updated: January 21, 2005

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To add a trusted root certification authority to a Group Policy object

Open the Group Policy object (GPO) that you want to edit.

In the console tree, click Trusted Root Certification Authorities.

Where?

Policy Object Name/Computer Configuration/Windows Settings/Security Settings/Public Key Policies/Trusted Root Certification Authorities

On the Action menu, point to All Tasks, and then click Import.

This starts the Certificate Import Wizard, which guides you through the process of importing a root certificate and installing it as a trusted root certification authority (CA) for this GPO.

Notes

To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.