How to install an SSL certificate on Zimbra Mail Server
The instructions below walk you through installing an SSL/TLS certificate on Zimbra Mail Server. If you have not generated your certificate or finished validation yet, see our CSR generation instructions.
What you will need
1. Your server certificate
This is the certificate the certificate authority issued for your domain. It may have been emailed to you. If not, you can download it from your account dashboard by clicking on your order.
2. Your intermediate certificates
These files let devices connecting to your server identify the issuing certificate authority. There may be more than one of them. If your certificate arrived in a ZIP folder, the intermediates — sometimes called the CA bundle — should be in there too. If not, download the right CA bundle for your certificate.
3. Your private key
This file should be on your server, or in your hands if you generated your CSR with a free generator tool.
SSL/TLS certificate installation instructions for Zimbra Mail Server
There are two ways to install the certificate:
A. Zimbra administration console — the web interface
B. Zimbra certificate manager — the command line (CLI)
A. Installing the SSL/TLS certificate from the Zimbra administration console
1. Configure
In the main menu, click Configure.
2. Certificates — Install Certificate
Select Certificates. Then click the gear icon at the top right, next to Help, and choose Install Certificate.
3. Choose the target server
On the Select the target server tab, pick your server from the Server Name drop-down. Click Next.
4. Choose the installation option
On the Choose the installation option tab, select Install the commercially signed certificate.
5. Review the certificate signing request
Go to the last tab, Review the certificate signing request. Check that every detail in the CSR is right, then click Next.
6. Upload the certificate
Go back up to the Upload the certificate tab, where you import each required file into the server.
Each of these files is emailed to the certificate's administrative and technical contacts, and can also be downloaded as a zip folder from your account.
In the example image the certificate is from Comodo and uses Comodo's own root and intermediate certificates. Do get in touch with our support team if you are unsure which certificate files your installation needs.
7. Install the certificate
Finally, go to the Install the certificate tab and click Install.
8. Restart
To apply the changes you just made, you need to restart the Zimbra services from the command line. Run these commands to switch to the Zimbra user:
sudo
su zimbraOnce you are the Zimbra user, restart the services with:
zmcontrol restartThat is it — your SSL certificate is installed on your Zimbra server.
B. Installing the SSL/TLS certificate with the Zimbra certificate manager (command line)
Zimbra ships with a tool called "zmcertmgr" for handling SSL certificates.
On version 8.6 or earlier this tool has to be run as root. On 8.7 or later, run it as the zimbra user. Run the following to switch from the default user to the Zimbra user.
sudo su
su zimbra1. Download the root CA certificate and save it to a temporary file
For example: /tmp/ca.crt
These files should be labelled inside the zip folder you can download from your account.
2. Combine the root and intermediate CA certificates into a temporary file
cat /tmp/ca_intermediary.crt /tmp/ca.crt > /tmp/ca_chain.crt3. Verify your certificate
/opt/zimbra/bin/zmcertmgr verifycrt comm \
/opt/zimbra/ssl/zimbra/commercial/commercial.key \
/opt/server_domain_com.crt \
/opt/server_domain_com.ca-bundle4. Deploy your SSL certificate
/opt/zimbra/bin/zmcertmgr deploycrt comm \
/opt/server_domain_com.crt \
/opt/server_domain_com.ca-bundle5. Verify the deployment
/opt/zimbra/bin/zmcertmgr viewdeployedcrt6. Restart Zimbra to apply the changes
Run these commands to switch to the Zimbra user:
sudo su
su zimbraOnce the default user has switched to Zimbra, restart the server with:
zmcontrol restartYour certificate should now be installed.
