Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate - Install & Setup

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

Myriad — Wed, 06 Dec 2023 17:07:00 +0000

@anahuac Nope, that was the article I was referencing from the beginning.

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

anahuac — Wed, 06 Dec 2023 14:43:05 +0000

Give this one a try Let’s Encrypt on Carbonio – System Root with ACME.sh

it might be exactly what you're looking for

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

Myriad — Tue, 05 Dec 2023 16:28:43 +0000

I am unable to get ssl to work using any of the methods shown above and in this forum in general. The only thing that worked for me was copying the LetsEncrypt files off of my old server and running the zmcertmgr commands on Carbonio using the Zimbra generated certs. My Carbonio server is a duplicate of my Zimbra one, with 'mail' as the sub domain of 'mail.example.ca'. I also run other domains as well but until I can get LE to work, Carbonio is dead in the water for me. One error I get (that might be related to this problem) when restarting the proxy after redirect is:

Starting proxy...nginx:  conflicting server name "mail.example.ca" on 0.0.0.0:443, ignored

And when I look at the error message returned in the LE failure email I see:

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

ENDCMD: mail.example.ca /opt/zextras/libexec/certbot certonly --agree-tos --email zextras@example.ca -n --keep --webroot -w /opt/zextras --cert-name example.ca -d mail.example..ca -d mail.example..ca

Seems like there are two '-d mail.example.ca' strings in the command line which is possibly caused by the proxy error above? In Zimbra I use John Dunphy's excellent, "Using Acme.sh to generate certs" with his automated script. Can this be adapted to work with Carbonio? I hope John can chime in here.

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

rwebb616 — Sat, 14 Oct 2023 15:47:47 +0000

@rwebb616

run this to get the setup you have now:

zmprov gs `zmhostname` zimbraReverseProxyMailMode

and this to fix it

zmprov ms `zmhostname` zimbraReverseProxyMailMode redirect

Well even though I KNOW I changed the setting it was still showing https when I ran the gs command. Switched to redirect - and this time verified that it changed, re-ran the certificate request and it worked. I also ran it for the second domain on the box and that worked as well. I would call this one solved! Thanks @anahuac for your help!

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

antonio — Sat, 14 Oct 2023 15:04:26 +0000

@anahuac, Hi this worked like a charm, thanks. You are the man.

I'm still a bit lost with multiserver conf: Do we need to change zimbraMtaLmtpHostLookup value and restarted all nodes?
or should I have done it in only in specific nodes? which ones?

Understood the 2 layers certificates.

"zmcertmgr viewdeployedcrt" gives me the information from 1st layer certificate - (created via cli and installed with su - zextras -c 'zmcertmgr deploycrt comm.....') what shall we do with this? what happend when expired? it has to be be updated like before with Zimbra, right?

Nice job.

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

anahuac — Fri, 13 Oct 2023 21:04:19 +0000

@rwebb616

run this to get the setup you have now:

zmprov gs `zmhostname` zimbraReverseProxyMailMode

and this to fix it

zmprov ms `zmhostname` zimbraReverseProxyMailMode redirect

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

anahuac — Fri, 13 Oct 2023 21:02:53 +0000

@rwebb616 Yes it does and it works great... just today I did it twice.. so I'm pretty impressed you're having issues.... maybe some FW blocking it?

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

rwebb616 — Fri, 13 Oct 2023 19:03:02 +0000

I just realized that it is NOT redirecting even though the setting is set to redirect. Is there anywhere else this needs to be changed?

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

rwebb616 — Fri, 13 Oct 2023 18:57:00 +0000

Do you know if the Carbonio proxy / web server is supposed to respond to the Let's Encrypt challenges and serve up the content in the .well-known/acme-challenge directory?

I just tried putting a .txt file in that folder and tried to get to it with https://mail.example.com/.well-known/acme-challenge/file.txt and I was successful so I'm not sure why it's not working with the certificate.

RE: Carbonio 23.9.0 admin panel trying to get a Let's Encrypt Certificate

rwebb616 — Fri, 13 Oct 2023 18:51:44 +0000

@rwebb616 You must setup your proxy to redirect as I explain in my tutorial

Let’s Encrypt on Carbonio – Easy as never before

@anahuac I mentioned in this post that I had read your blog posting and followed all instructions including setting the mode to redirect. I have port 80 and 443 on my public IP address forwarded to the Carbonio server - no proxy in-between other than the Carbonio proxy.

Do you know if the Carbonio proxy / web server is supposed to respond to the Let's Encrypt challenges and serve up the content in the .well-known/acme-challenge directory?