@trigg3r roll up a bit... there are many messages showing the right lines you have to change.. please read the previous posts.
Hai solved with this: https://github.com/Zimbra/zm-core-utils/pull/137
adding "-propquery", "-fips" (not "-")
thank you!
hi,
i have a similar problem but my error is different. I try to distribute a commercial certificate. if I do the check the result is OK.
i I already tried changing the properties in "-nomac" or "-propquery", "-fips"
[zimbra@mail ~]$ /opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/ca_chain.crt ** Verifying '/tmp/commercial.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key' Certificate '/tmp/commercial.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match. ** Verifying '/tmp/commercial.crt' against '/tmp/ca_chain.crt' Valid certificate chain: /tmp/commercial.crt: OK [zimbra@mail ~]$ /opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/ca_chain.crt ** Fixing newlines in '/tmp/ca_chain.crt' Can't rename /tmp/ca_chain.crt to /tmp/ca_chain.crt.bak: Operation not permitted, skipping file at /opt/zimbra/bin/zmcertmgr line 1239. ** Verifying '/tmp/commercial.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key' Certificate '/tmp/commercial.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match. ** Verifying '/tmp/commercial.crt' against '/tmp/ca_chain.crt' Valid certificate chain: /tmp/commercial.crt: OK ** Copying '/tmp/commercial.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' ** Copying '/tmp/ca_chain.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' ** Appending ca chain '/tmp/ca_chain.crt' to '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' ** Importing cert '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt' as 'zcs-user-commercial_ca' into cacerts '/opt/zimbra/common/lib/jvm/java/lib/security/cacerts' ** NOTE: restart mailboxd to use the imported certificate. ** Saving config key 'zimbraSSLCertificate' via zmprov modifyServer mail.xxx.it...ERROR: account.INVALID_ATTR_VALUE (invalid attr value: invalid attr value - unable to modify attributes: ldap host=mail.xxx.it:389: zimbraSSLCertificate: value #0 invalid per syntax) (cause: com.zimbra.cs.ldap.LdapException$LdapInvalidAttrValueException invalid attr value - unable to modify attributes: ldap host=mail.xxx.it:389: zimbraSSLCertificate: value #0 invalid per syntax) failed (rc=2) ** Installing imapd certificate '/opt/zimbra/conf/imapd.crt' and key '/opt/zimbra/conf/imapd.key' ** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.crt' to '/opt/zimbra/conf/imapd.crt' ** Copying '/opt/zimbra/ssl/zimbra/commercial/commercial.key' to '/opt/zimbra/conf/imapd.key' ** Creating file '/opt/zimbra/ssl/zimbra/jetty.pkcs12' ERROR: openssl pkcs12 export to '/opt/zimbra/ssl/zimbra/jetty.pkcs12' failed(1): No cert in -in file '/opt/zimbra/conf/imapd.crt' matches private key 8003D8AF467F0000:error:05800074:x509 certificate routines:X509_check_private_key:key values mismatch:crypto/x509/x509_cmp.c:405: 8003D8AF467F0000:error:05800074:x509 certificate routines:X509_check_private_key:key values mismatch:crypto/x509/x509_cmp.c:405:
I resolved the commercial certificate was not in the format required by zimbra
Although it seems like is a solved topic, I want to share my experience with this error.
My zimbra installation was 9.0.0_ZEXTRAS_20221203 on Rocky Linux 8.8, so when I was renewing the SSL Certificate by zmcertmgr I got the following:
command: /opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/server.crt /tmp/ca_bundle.crt
ERROR: openssl pkcs12 export to '/opt/zimbra/ssl/zimbra/jetty.pkcs12' failed(1):
Error creating PKCS12 MAC; no PKCS12KDF support?
Use -nomac if MAC not required and PKCS12KDF support not available.
0061F3F3637F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (PKCS12KDF : 192), Properties (<null>)
0061F3F3637F0000:error:1180006B:PKCS12 routines:pkcs12_gen_mac:key gen error:crypto/pkcs12/p12_mutl.c:147:
0061F3F3637F0000:error:1180006D:PKCS12 routines:PKCS12_set_mac:mac generation error:crypto/pkcs12/p12_mutl.c:220:
After some search I didn't find a solution that works for me, fortunately I had a prototype server with same configuration to play a little, I downloaded and installed the release 9.0.0_ZEXTRAS_20231104.RHEL8_64_20231124123142 after upgrade I issued the same command to install the new certificate, this time it worked like a charm. and after restart zimbra I finally got my server working.
