How to Install SSL Certificate on Zimbra version 5, 6, 7 & 8 Server

Apr 20, 2023

On the Choose the Installation Option tab. Then, click the bubble for Install the commercially signed certificate.

This document provides installation instructions for Zimbra server. If you are not able to perform the steps on the server, Symantec recommends that you contact Zimbra vendor.

Step 1: Obtain the SSL Certificate

Please click here to download the certificate from your account
To install the SSL Certificate on Zimbra server, perform one of the following methods:

Method 1. Install the SSL certificate using Command Line Interface (CLI)

Step 2. Download the Root CA

Download the Root and Intermediate certificate from here. Save Root CA certificate file (e.g. /tmp/ca.crt )
Move the Intermediate and Root certificates to the same directory. (e.g. /tmp/ca_intermediate.crt )
Combine Root and Intermediate CA files into a temporary file using cat command

cat /tmp/ca.crt /tmp/Intermediate_CA.crt > /tmp/ca_chain.crt

Step 3. Install the SSL Certificate

Verify the ssl certificate with the following zmcertmgr command

/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/ca_chain.crt
**Verifying /tmp/commercial.crt against /opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (/tmp/commercial.crt) and private key
(/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
Valid Certificate: /tmp/commercial.crt: OK

NOTE : The private key (e.g. /opt/zimbra/ssl/zimbra/commercial/commerical.key ) is created on the Zimbra server . If the private key no longer exist on the server, a new CSR will have to be generated and submit a certificate replacement.

To deploy the ssl certificate, run the following zmcertmgr command.

/opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/ca_chain.crt ** Verifying /tmp/commercial.crt against
/opt/zimbra/ssl/zimbra/commercial/commercial.key
Certificate (/tmp/commercial.crt) and private key
(/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
Valid Certificate: /tmpt/commercial.crt: OK
**Copying commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
**Appending ca chain /tmp/ca_chain.crt to
/opt/zimbra/ssl/zimbra/commercial/commercial.crt
**Saving server config key zimbraSSLCeretificate…done.
**Saving server config key zimbraSSLPrivateKey…done.
**Installing mta certificate and key…done.
**Installing slapd certificate and key…done.
**Installing proxy certificate and key…done.
**Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12…done.
**Creating keystore file /opt/zimbra/mailbox/etc/keystore…done.
**Installing CA to /opt/zimbra/conf/ca…done.
To verify if the ssl certificate has been successfully deployed. Run the following zmcertmgr command.

/opt/zimbra/bin/zmcertmgr viewdeployedcrt
For more information on Zimbra server using CLI commands click here

Method 2: Install the SSL Certificate through the Admin Console

Download the Root certificate from here
Download the server and intermediate certificate from here
In the main menu, click Configure.
Select Certificates. Then, click the gear icon on the top right (next to Help) and select Install Certificate.
On the Select the Target Server tab, select your server from the Server Name drop-down menu. Click Next.
On the Choose the Installation Option tab. Then, click the bubble for Install the commercially signed certificate.
Go to the last tab, Review the Certificate Signing Request. Verify that all of the CSR information is correct, then click Next.
Go back up to the Upload the Certificate tab where you will import each required file to the server.
Finally, go to the Install the Certificate tab and click Install.
To apply the changes you’ve just made, you’ll need to restart Zimbra services using the Command Line Interface. Enter these commands to switch to Zimbra user:

sudo su
su zimbra
Once the user is switched to Zimbra user, restart the services using following command:

zmcontrol restart