zimbra: multiple letsencrypt certificates and Unable to start TLS error

The following guide is tested against zimbra 8.8: Installing a Let’s Encrypt SSL Certificate

If this error occurs: ‘Unable to start TLS: hostname verification failed when connecting to ldap master.‘
make sure you have included your hostname in your letsencrypt signing domains and follow the guide once again.
For instance, if your hostname is mail5.example.com, use letsencrypt to sign mail5.example.com along with all other domains.

Example:

[email protected]:~/tmp/letsencrypt# ./letsencrypt-auto certonly --standalone -d mail5.example.com -d mail.example.com -d webmail.example.com -d mail.test.com -d webmail.test.com

Make also sure you append https://www.identrust.com/certificates/trustid/root-download-x3.html to chain.pem

The whole procedure seems a bit tricky but actually it’s easy and it works.

Hopefully, some clever people have developed a bunch of scripts to automate the whole procedure, not all of them work in all cases. We have successfully tested the first automated method (https://github.com/VojtechMyslivec/letsencrypt-zimbra/) and it works great, as long as you keep incuding hostname in your config to avoid the “Unable to start TLS” error.

So open up your config at:

/opt/letsencrypt-zimbra/letsencrypt-zimbra.cfg

And edit the line with common names:

common_names=( "mail5.example.com" "mail.example.com" "webmail.example.com" "mail.test.com" "webmail.test.com" )

Automated method installation instructions are very simple – just follow them here: https://github.com/VojtechMyslivec/letsencrypt-zimbra/

The manual method, although hasn’t any real difficulties, has some steps though that might prove a nightmare when it comes to renew certs every 3 months for letsencrypt certs. Anyhow, for all of you manual people, steps are the following:

• Stop zimbra services: zmcontrol stop
• Use letsencrypt to fetch the certificates: ./letsencrypt-auto certonly --standalone -d mail5.example.com -d mail.example.com -d webmail.example.com -d mail.test.com -d webmail.test.com. If asked, select expand (E).
• Append missing certificate to chain.pem
• Copy created certificates to zimbra location: cp /etc/letsencrypt/live/mail5.example.com/* /opt/zimbra/ssl/letsencrypt/
• Set rights: chown zimbra:zimbra /opt/zimbra/ssl/letsencrypt/*
• Login as zimbra: su - zimbra
• Goto certificates path: cd /opt/zimbra/ssl/letsencrypt
• Check certificate validity: /opt/zimbra/bin/zmcertmgr verifycrt comm privkey.pem cert.pem chain.pem
• Take a backup: cp -a /opt/zimbra/ssl/zimbra /opt/zimbra/ssl/zimbra.$(date "+%Y%m%d")
• Deploy certificates to zimbra installation: /opt/zimbra/bin/zmcertmgr deploycrt comm cert.pem chain.pem
• Restart zimbra: zmcontrol restart