<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>I always use this command from the CLI to check if my cert works,</div><div>you should try and fix your issue from the CLI first, then after that</div><div>says `Valid Certificate...OK` you can try the web interface.</div><div><br data-mce-bogus="1"></div><div><pre class="code" style="margin: 0px 0px 1.4em; padding: 0.7em 1em; font-family: Consolas, 'Andale Mono WT', 'Andale Mono', 'Bitstream Vera Sans Mono', 'Nimbus Mono L', Monaco, 'Courier New', monospace; font-size: 14px; direction: ltr; text-align: left; background-color: #ffffff; color: #333333; box-shadow: #cccccc 0px 0px 0.5em inset; border-radius: 2px; overflow: auto; word-wrap: normal; border: 1px solid #cccccc; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="margin: 0px 0px 1.4em; padding: 0.7em 1em; font-family: Consolas, 'Andale Mono WT', 'Andale Mono', 'Bitstream Vera Sans Mono', 'Nimbus Mono L', Monaco, 'Courier New', monospace; font-size: 14px; direction: ltr; text-align: left; background-color: #ffffff; color: #333333; box-shadow: #cccccc 0px 0px 0.5em inset; border-radius: 2px; overflow: auto; word-wrap: normal; border: 1px solid #cccccc; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;"> /opt/zimbra/bin/zmcertmgr verifycrt comm private.key your.crt intermediate.crt
</pre></div><div>This way you know for sure you have the correct intermediate.</div><div><br data-mce-bogus="1"></div><div data-marker="__SIG_PRE__">Kind regards, <br><br>Barry de Graaff<br>Zeta Alliance <br>Co-founder & Developer<br>zetalliance.org | github.com/Zimbra-Community<br><br>+31 617 220 227 | skype: barrydegraaff.tk<br>Fingerprint: 97f4694a1d9aedad012533db725ddd156d36a2d0</div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Frédéric Nass" <frederic.nass@univ-lorraine.fr><br><b>To: </b>"Barry de Graaff" <info@barrydegraaff.tk><br><b>Cc: </b>"users" <users@lists.zetalliance.org><br><b>Sent: </b>Thursday, May 17, 2018 10:06:40 AM<br><b>Subject: </b>Re: [Users] New 8.7.5 Securemail Zimlet<br></div><div><br></div><div data-marker="__QUOTED_TEXT__"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br><div>Thanks for all these informations Barry. I have root access and I could add certs to the keystore but verification still fails when uploading my personnal cert in Zimbra preferences (because the verification against all Comodo certs that I add to the keystore still fails).<br></div><div><br>I used "zmcertmgr addcacert /tmp/comodo.crt" that uses keytool to import certificate to the keystore. It must be equivalent to "keytool -import -alias xxxxxxx -keystore /opt/zimbra/common/lib/jvm/java/jre/lib/security/cacerts -storepass changeit -file /tmp/comodo.crt"</div><br><div>Frédéric.<br></div><br><div><br><span id="zwchr">----- Le 17 Mai 18, à 9:33, Barry de Graaff <info@barrydegraaff.tk> a écrit :<br></span></div><div><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;">Ahh, AFAIK you do not have to concatenate them.<br><br>Instead you can add all required intermediates to the store,<br>you need to restart zimbra for the changes to be loaded.<br><br>I do not use S/MIME so I cannot give the exact example, but<br>for trusting a CA using intermediates I do:<br><br>wget https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt -O lets.pem<br> /opt/zimbra/common/bin/keytool -import -alias letsenc-ca -keystore /opt/zimbra/common/etc/java/cacerts -storepass changeit -file /root/lets.pem<br><br>So the trick there is to get the proper .pem from you CA and import that into<br>the keystore.<br><br>You can also create a new keystore and put that in<br>smime_truststore variable.<br><br>You write you cannot add a cert to the store, do you not have root access?<br><br><br>Kind regards, <br><br>Barry de Graaff<br>Zeta Alliance <br>Co-founder & Developer<br>zetalliance.org | github.com/Zimbra-Community<br><br>+31 617 220 227 | skype: barrydegraaff.tk<br>Fingerprint: 97f4694a1d9aedad012533db725ddd156d36a2d0<br><br>----- Original Message -----<br>From: "Frédéric Nass" <frederic.nass@univ-lorraine.fr><br>To: "Barry de Graaff" <info@barrydegraaff.tk><br>Cc: "users" <users@lists.zetalliance.org><br>Sent: Thursday, May 17, 2018 9:26:18 AM<br>Subject: Re: [Users] New 8.7.5 Securemail Zimlet<br><br>Hi Barry,<br><br>I have no idea.<br><br>Actually, Zimbra provides a keystore for smime certs validation. But <br>it's empty from any trusty external CA.<br><br>[zimbra@test-zimbra ~]$ zmlocalconfig | grep -E 'keystore|smime'<br>imapd_keystore = /opt/zimbra/conf/imapd.keystore<br>imapd_keystore_password = *<br>mailboxd_keystore = /opt/zimbra/mailboxd/etc/keystore<br>mailboxd_keystore_base = ${zimbra_home}/conf/keystore.base<br>mailboxd_keystore_base_password = *<br>mailboxd_keystore_password = *<br>smime_truststore = ${mailboxd_truststore}<br>smime_truststore_password = *<br><br>[zimbra@test-zimbra ~]$ keytool -list -keystore <br>/opt/zimbra/common/lib/jvm/java/jre/lib/security/cacerts -storepass changeit<br><br>Keystore type: JKS<br>Keystore provider: SUN<br><br>Your keystore contains 183 entries<br><br>tmp/rhel7_64/rdjz3bwn1d/eq0xx_t6fv.der, Feb 12, 2016, trustedCertEntry,<br>Certificate fingerprint (SHA1): <br>85:37:1C:A6:E5:50:14:3D:CE:28:03:47:1B:DE:3A:09:E8:F8:77:0F<br>tmp/rhel7_64/rdjz3bwn1d/gpzzm9h5_7.der, Feb 12, 2016, trustedCertEntry,<br>Certificate fingerprint (SHA1): <br>8C:96:BA:EB:DD:2B:07:07:48:EE:30:32:66:A0:F3:98:6E:7C:AE:58<br>tmp/rhel7_64/rdjz3bwn1d/csuq6zjk4u.der, Feb 12, 2016, trustedCertEntry,<br>...<br>Certificate fingerprint (SHA1): <br>AE:C5:FB:3F:C8:E1:BF:C4:E5:4F:03:07:5A:9A:E8:00:B7:F7:B6:FA<br>my_ca, Mar 21, 2018, trustedCertEntry,<br>...<br>Certificate fingerprint (SHA1): <br>D1:EB:23:A4:6D:17:D6:8F:D9:25:64:C2:F1:F1:60:17:64:D8:E3:49<br>tmp/rhel7_64/rdjz3bwn1d/ja63m4kjkn.der, Feb 12, 2016, trustedCertEntry,<br>Certificate fingerprint (SHA1): <br>48:12:BD:92:3C:A8:C4:39:06:E7:30:6D:27:96:E6:A4:CF:22:2E:7D<br>tmp/rhel7_64/rdjz3bwn1d/0wpwao5qj3.der, Feb 12, 2016, trustedCertEntry,<br>Certificate fingerprint (SHA1): <br>28:90:3A:63:5B:52:80:FA:E6:77:4C:0B:6D:A7:D6:BA:A6:4A:F2:E8<br>tmp/rhel7_64/rdjz3bwn1d/8afyoy3e6h.der, Feb 12, 2016, trustedCertEntry,<br>etc.<br><br>But no Comodo, Verisign, etc...<br><br>I added all the certs from <br>https://support.comodo.com/index.php?/Knowledgebase/List/Index/71 to the <br>keystore. But verification still fails when uploading personal certs.<br><br>Prabhat Kumar on comment 3 of bugzilla report says "Need to add <br>intermediate as well of the s/mime certificate."<br>Which I did, but still no success.<br><br>It seems to me that I should first build a cert by concatenating some <br>root and intermediate certs. But which certs in what order I have no <br>idea :-/<br><br>Regards,<br>Frédéric.<br><br><br>Le 17/05/2018 à 09:04, Barry de Graaff a écrit :<br>> Is this an open-source component, especially the server side part?<br>><br>> If so you can look in there an see if you can use a different keystore.<br>><br>> Kind regards,<br>><br>> Barry de Graaff<br>> Zeta Alliance<br>> Co-founder & Developer<br>> zetalliance.org | github.com/Zimbra-Community<br>><br>> +31 617 220 227 | skype: barrydegraaff.tk<br>> Fingerprint: 97f4694a1d9aedad012533db725ddd156d36a2d0<br>><br>> ----- Original Message -----<br>> From: "Frédéric Nass" <frederic.nass@univ-lorraine.fr><br>> To: "users" <users@lists.zetalliance.org><br>> Sent: Thursday, May 17, 2018 8:32:16 AM<br>> Subject: [Users] New 8.7.5 Securemail Zimlet<br>><br>> Hi,<br>><br>> Has anyone succeded in using the new 8.7.5 securemail Zimlet<br>> (com_zimbra_securemail)?<br>><br>> Personnal certificates uploads fail unless you disable the certificate<br>> verification check or add the root CA to Zimbra keystore which I can't<br>> do. This has been explained here :<br>> https://bugzilla.zimbra.com/show_bug.cgi?id=107887<br>> Problem is that Zimbra does not provide any external CA keystore to<br>> validate personnal certificates.<br>><br>> There is no documentation and Zimbra support is as usual of no help.<br>><br>> Regards,<br>></blockquote></div></div><br></div></div></body></html>