Webmail/admin login fails with 502 Bad Gateway on GET /zx/login/v3/auth/config. Traced this to the carbonio-proxy upstream carbonio-auth, which routes to 127.78.0.1:20008 (an Envoy sidecar). The sidecar itself is up and listening, but nothing is registered behind it.

What I've confirmed:

• consul catalog services shows no carbonio-auth entry at all (not unhealthy — completely absent)
• No .hcl file for it exists in /etc/zextras/service-discover/ (only carbonio-proxy.hcl references the name, as a destination)
• No systemd unit carbonio-auth-sidecar.service exists anywhere on disk
• dpkg -S carbonio-auth-sidecar returns no matching package
• apt-cache search carbonio | grep auth and apt list -a carbonio-auth* show only carbonio-auth-ui (a frontend module), no backend service
• Not served directly by mailboxd either (curl localhost:8080/zx/login/v3/auth/config → 404)
• No trace of any process ever attempting to register this service name in mailbox.log
• pending-setups -a runs clean, nothing pending
• Full zmcontrol restart and individual service restarts don't resolve it
• Repointing the proxy upstream to carbonio-user-management (the service that appears to actually handle auth-related SOAP requests) also didn't resolve it — reverted that change

What's healthy: everything else — mail delivery, IMAP, SMTP, LDAP, MTA, proxy itself, mailbox backend. This is isolated to the webmail/admin login flow specifically.

Found one other user with the exact same symptom (community.zextras.com/forum/carbonio-general-thread/carbonio-auth-problem/, Feb 2024) with no public resolution shown.

Is carbonio-auth supposed to be provided by a specific package? Was it possibly deprecated/replaced by carbonio-user-management in a later version and this proxy template just wasn't updated to match? Any pointers appreciated.

Webmail/admin login fails with 502 Bad Gateway on GET /zx/login/v3/auth/config. Traced this to the carbonio-proxy upstream carbonio-auth, which routes to 127.78.0.1:20008 (an Envoy sidecar). The sidecar itself is up and listening, but nothing is registered behind it.

What I've confirmed:

• consul catalog services shows no carbonio-auth entry at all (not unhealthy — completely absent)
• No .hcl file for it exists in /etc/zextras/service-discover/ (only carbonio-proxy.hcl references the name, as a destination)
• No systemd unit carbonio-auth-sidecar.service exists anywhere on disk
• dpkg -S carbonio-auth-sidecar returns no matching package
• apt-cache search carbonio | grep auth and apt list -a carbonio-auth* show only carbonio-auth-ui (a frontend module), no backend service
• Not served directly by mailboxd either (curl localhost:8080/zx/login/v3/auth/config → 404)
• No trace of any process ever attempting to register this service name in mailbox.log
• pending-setups -a runs clean, nothing pending
• Full zmcontrol restart and individual service restarts don't resolve it
• Repointing the proxy upstream to carbonio-user-management (the service that appears to actually handle auth-related SOAP requests) also didn't resolve it — reverted that change

What's healthy: everything else — mail delivery, IMAP, SMTP, LDAP, MTA, proxy itself, mailbox backend. This is isolated to the webmail/admin login flow specifically.

Found one other user with the exact same symptom (community.zextras.com/forum/carbonio-general-thread/carbonio-auth-problem/, Feb 2024) with no public resolution shown.

Is carbonio-auth supposed to be provided by a specific package? Was it possibly deprecated/replaced by carbonio-user-management in a later version and this proxy template just wasn't updated to match? Any pointers appreciated.

We've run into an issue with Carbonio CE 4.25.2 and would like to share our findings, since it looks like a known long-standing behavior inherited from Zimbra rather than something new.

Problem description

Attachments with Content-Type application/pkcs7-signature (typically .p7s files — standalone signed documents, e.g. tax/legal/HR documents signed with a qualified electronic signature) are not shown in the Carbonio web client, neither while composing a message nor when reopening a message from the Sent folder. The attachment simply doesn't appear in the UI, as if nothing were attached.

The attachment is NOT actually lost, though:

• The file is correctly received and stored by FileUploadServlet (confirmed via mailbox.log — "saveUpload(): received Upload" entries show the file coming in fine).
• The message is sent with the attachment intact.
• Any other mail client (Thunderbird, Outlook, other IMAP clients) correctly shows and downloads the very same attachment from the very same message.

So it's purely a web client display issue — not an MTA, antivirus, or attachment-blocking problem. We already ruled out:

• zimbraMtaBlockedExtension (p7s/p7m are not in that list)
• Antivirus/antispam (mail is delivered with the attachment intact either way)

Example MIME headers of the affected attachment part

Content-Type: application/pkcs7-signature;
 name="...filename...pdf.p7s"
Content-Disposition: attachment;
 filename="...filename...pdf.p7s"
Content-Transfer-Encoding: base64

Important detail: in our case this attachment is NOT part of a multipart/signed structure — it's not a signature over the message itself (S/MIME-style). It's a plain regular attachment whose payload happens to be a PKCS#7 signed document, which is a common pattern in several countries' e-government/e-document workflows (e.g. Italian PEC "atti.p7m", Ukrainian tax/HR documents "*.pdf.p7s"). It looks like the client filters/hides any attachment part with this Content-Type regardless of the surrounding MIME structure.

This looks like the same issue as an old Zimbra bug

This exact behavior existed in Zimbra for years and is documented as Zimbra Bugzilla #69476: the web client was changed to ignore application/pkcs7-signature parts, apparently to hide the actual S/MIME signature part of signed messages. The side effect was that any attachment using this same Content-Type got hidden too, breaking legitimate cases where the p7s/p7m file is a standalone signed document rather than a signature over the message.

A community-maintained Zimlet was published back then specifically to work around it: zimbra-patches (folder tk_barrydegraaff_enable_pkcs7_signature) — described as reverting the ignoring of application/pkcs7-signature introduced by that bug.

Since Carbonio's web client is a full rewrite (React-based, not Ext/Zimlet-based anymore), that old Zimlet fix obviously doesn't apply here, but the same filtering logic seems to have carried over conceptually.

Possibly related area of the code

Carbonio added native S/MIME support in carbonio-mailbox (PR #646, released in 4.20.0, Feb 2025). That's likely the place where application/pkcs7-signature parts get special-cased and excluded from what's shown to the client.

What we'd love to see

Ideally, the filtering would only apply when the pkcs7-signature part is actually a child of a multipart/signed structure (i.e. a real S/MIME signature on the message), so that standalone p7s/p7m attachments — a very common real-world document type in several jurisdictions — show up normally in the UI, just like they already do in any IMAP client.

Happy to share full raw message headers or a test message/log excerpt if that helps track this down. Has anyone else run into this, or found a workaround on the Carbonio side?

Thanks!

First of all, thanks for all your work on Carbonio.

I'm writing to request a feature that seems to be missing in the current version of Carbonio (I'm on the latest release): the ability to edit an already created Contact Group.

What I'm trying to do

I have an existing contact group and I need to add 1 or 2 more addresses to it. Currently, there is no option in the web UI to modify a group once it has been saved.

What I've checked

• The official user documentation (Working with Contacts) includes entries for Creating, Using, and Sharing a Contact Group, but there is no section for Editing one.
• Contact groups can't even be seen in the contact list view for further modification (they don't appear in the list, unlike in Zimbra).
• As a workaround, I have to recreate the entire group from scratch and delete the old one, which is not practical when the group has many members.

Request

It would be really helpful to have:

1. An "Edit" option for existing contact groups (right-click → Edit Contact Group, or similar).
2. Contact groups to be visible in the contact list when filtering by "Groups" (as it already does with the View Filter), so they can be selected and modified.

In Zimbra this was fully supported (contact, group, and distribution sections), so there is an expectation from users migrating over.

Any feedback on whether this is planned for a future release would be greatly appreciated.

Thanks in advance!

The log says "status=bounced (host my.relay.server said: 530 From/Sender name is not valid (in reply to end of DATA command))

Normail sending and receiving works fine. Any advice is greatly appreciated!

/Cheers

I've just migrated to Carbonio CE and for me its the latest in a long line of migrations.  Pegasus Mail, Zarafa and Kolab have been in there so I have a little experience of email apps.

So mostly things have been going well, however I have come across a few oddities/quirks and I've managed to work around most.

The one I want to mention though, is the global disclaimer as I think there might be a bug lurking here.

When using the android app, all is well, both text and HTML disclaimers work fine. The same is true when using Thunderbird as the client.  The issue arises when using the web client. It doesn't send the rich text disclaimer but does when using the text only. If I send as rich text and read it as plain text, I will see the plain text disclaimer.  Looking at the email source text shows only the plain text disclaimer.

Looking forward to what people come up with.

Regards

Tanathka

And in the browser

POST /service/admin/soap/GetVolumeRequest
422 Unprocessable Entity


HELP

root@**:/opt/zextras/log# ss -tlnp | grep -E ":(25|587|465) "
LISTEN 0 100 0.0.0.0:25 0.0.0.0:* users:(("smtpd",pid=35508,fd=6),("master",pid=2713,fd=13))
LISTEN 0 100 :25 :* users:(("smtpd",pid=35508,fd=7),("master",pid=2713,fd=14))

How do I re-enable the submission ports?