My zimbra installation was 9.0.0_ZEXTRAS_20221203 on Rocky Linux 8.8, so when I was renewing  the SSL Certificate  by zmcertmgr I got the following:

command: /opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/server.crt /tmp/ca_bundle.crt

ERROR: openssl pkcs12 export to '/opt/zimbra/ssl/zimbra/jetty.pkcs12' failed(1):
Error creating PKCS12 MAC; no PKCS12KDF support?
Use -nomac if MAC not required and PKCS12KDF support not available.
0061F3F3637F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (PKCS12KDF : 192), Properties (<null>)
0061F3F3637F0000:error:1180006B:PKCS12 routines:pkcs12_gen_mac:key gen error:crypto/pkcs12/p12_mutl.c:147:
0061F3F3637F0000:error:1180006D:PKCS12 routines:PKCS12_set_mac:mac generation error:crypto/pkcs12/p12_mutl.c:220:

After some search I didn't find a solution that works for me, fortunately I had a prototype server with same configuration to play a little, I downloaded  and installed the release 9.0.0_ZEXTRAS_20231104.RHEL8_64_20231124123142  after upgrade  I  issued the same command to install the new certificate, this time it worked like a charm. and after restart  zimbra I finally got my server working.

i have a similar problem but my error is different. I try to distribute a commercial certificate. if I do the check the result is OK.

i I already tried changing the properties in "-nomac" or "-propquery", "-fips" 

$ /opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/ca_chain.crt
** Verifying '/tmp/commercial.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
Certificate '/tmp/commercial.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.
** Verifying '/tmp/commercial.crt' against '/tmp/ca_chain.crt'
Valid certificate chain: /tmp/commercial.crt: OK
$ /opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/ca_chain.crt
** Fixing newlines in '/tmp/ca_chain.crt'
Can't rename /tmp/ca_chain.crt to /tmp/ca_chain.crt.bak: Operation not permitted, skipping file at /opt/zimbra/bin/zmcertmgr line 1239.
** Verifying '/tmp/commercial.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
Certificate '/tmp/commercial.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.
** Verifying '/tmp/commercial.crt' against '/tmp/ca_chain.crt'
Valid certificate chain: /tmp/commercial.crt: OK
** Copying '/tmp/commercial.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'
** Copying '/tmp/ca_chain.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt'
** Appending ca chain '/tmp/ca_chain.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt'
** Importing cert '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' as 'zcs-user-commercial_ca' into cacerts '/opt/zimbra/common/lib/jvm/java/lib/security/cacerts'
** NOTE: restart mailboxd to use the imported certificate.
** Saving config key 'zimbraSSLCertificate' via zmprov modifyServer mail.xxx.it...ERROR: account.INVALID_ATTR_VALUE (invalid attr value: invalid attr value - unable to modify attributes: ldap host=mail.xxx.it:389: zimbraSSLCertificate: value #0 invalid per syntax) (cause: com.zimbra.cs.ldap.LdapException$LdapInvalidAttrValueException invalid attr value - unable to modify attributes: ldap host=mail.xxx.it:389: zimbraSSLCertificate: value #0 invalid per syntax)
failed (rc=2)
** Installing imapd certificate '/opt/zimbra/conf/imapd.crt' and key '/opt/zimbra/conf/imapd.key'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/imapd.crt'
** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/imapd.key'
** Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12'
ERROR: openssl pkcs12 export to '/opt/zimbra/ssl/zimbra/jetty.pkcs12' failed(1):
No cert in -in file '/opt/zimbra/conf/imapd.crt' matches private key
8003D8AF467F0000:error:05800074:x509 certificate routines:X509_check_private_key:key values mismatch:crypto/x509/x509_cmp.c:405:
8003D8AF467F0000:error:05800074:x509 certificate routines:X509_check_private_key:key values mismatch:crypto/x509/x509_cmp.c:405:

adding "-propquery", "-fips"  (not "-nomac")

thank you!

Thank al lot @anahuac!

How can I recognize for sure which line I have to modify?

Solo che il mio file /opt/zimbra/bin/zmcertmgr  non contiene la parola "nomac" :\

Ho provato a reinstallare Zimbra: tutto va a buon fine ma il problema rimane.

Ho provato a scaricare e reinstallare zextras-theme-ubuntu.tgz e ottendo un errore sul deploy:

su - zimbra -c 'zmskindeploy /opt/zimbra/jetty/webapps/zimbra/skins/zextras/'

ERROR: zclient.IO_ERROR (invoke PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed, server: localhost) (cause: javax.net.ssl.SSLHandshakeException PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed)

Sono fermo con il server ... mi potete aiutare??

Grazie

   1817         @out = $self->run(
   1818             $self->Openssl, "pkcs12", "-inkey", $keyf,
   1819             "-in",          $crtf,    "-name",  $server,
   1820             "-export",      "-out",   $pkcsf,   "-passout",
   1821             "pass:$kpass", "-nomac", "2>&1"
   1822         );

   1878         @out = $self->run(
   1879             $self->Openssl, "pkcs12", "-inkey", $keyf,
   1880             "-in",          $crtf,    "-name",  $server,
   1881             "-export",      "-out",   $pkcsf,   "-passout",
   1882             "pass:$kpass", "-nomac", "2>&1"
   1883         );

@mrom 

Thanks, this solution worked for me!!  with bellow configuration

Linux  4.15.0-112-generic #113-Ubuntu SMP Thu Jul 9 23:41:39 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-112-generic x86_64)

Release 9.0.0.ZEXTRAS.20221203.UBUNTU18.64 UBUNTU18_64 FOSS edition.

Thanks for the solution, life saving.