Voir la source de MTA/Zimbra/Administration Console and CLI Certificate Tools

ZCS allows administrators to manage their certificates using either the Administration Console or the Command Line Interface (CLI). This article discusses the ZCS 7.0.x, 6.0.x, and 5.0.x Administration Console, and the CLI tools for ZCS 7.0.x, 6.0.x, 5.0.x and 4.5.x.

{{Admon/note|iPhone SSL certificates|For information about iPhone SSL certificates, see http://wiki.zimbra.com/wiki/IPhone}}

=ZCS Administration Console Certificates Tools=
The ZCS Certificates tools are located in the Navigation pane, under '''Tools>Certificates'''. Once you have selected '''Certificates''' from this menu, the Manage Certificates tab opens in the Content pane. From here, you can view your deployed certificates or install a new certificate.

[[image:ZimbraAdminConsoleManageCerts.png]]

==Viewing Certificates==
Using the Administration Console, you can view the details of certificates currently deployed.  Details include the certificate subject, issuer, validation days, and subject alternative name.

To view a certificate, select a service host name, either under '''Certificates''' in the Navigation pane or by selecting a Service host name in the Manage Certificates tab and clicking '''View Certificate'''.  A Certificates tab for the service host name you selected opens in the Content Pane.

You can refresh the currently displayed details by clicking '''Refresh''' at the top of the tab.

==Installing Certificates==
Clicking '''Install Certificate''' from either the Manage Certificates tab or a Certificates tab opens the Certificate Installation Wizard.  The Certificate Installation Wizard is a tool that will help you quickly create and deploy a certificate.

===Generating Multiple CSRs using the Administration Console===

Currently the Administration Console only supports having one Certificate Signing Request (CSR) and private key at a time. Generating a new CSR overrides the existing one and generates a new private key. To generate more than one CSR, move both the CSR and key from the directory it is generated in (E.g. /opt/zimbra/ssl/zimbra/commercial directory/) before generating another CSR.

==Maintaining Valid Certificates==
It is important to keep your SSL certificates valid to ensure clients and environments work properly, as the ZCS system can become non-functional if certificates are allowed to expire. You can view deployed SSL certificates from the ZCS administrator console, including their validation days. It is suggested that certificates are checked periodically, so you know when they expire and to maintain their validity.

=ZCS Certificate CLI=
The ZCS Certificate CLI commands for 7.0.x, 6.0.x and 5.0.x differ from 4.5.x. The following sections discuss the CLI tools for each version.

==ZCS 7.0.x, 6.0.x, and 5.0.x==

===zmcertmgr===
This command allows you to manage certificates.

====General Guidelines====
Follow these guidelines when using this command.
*This tool must be run as root
=====Commercial Certificate Guidelines=====
Follow these guidelines when using this command to generate a commercial certificate.
*The private key must exist in the '''/opt/zimbra/ssl/zimbra/commercial''' directory, and must be named '''commercial.key''' with its permission set to '''740'''
*The server certificate and the chain certificate files must exist in a temp directory. (E.g. /root/certs/)
*The chain certificate files must be concatenated into one file called '''commercial_ca.crt'''

====Syntax====
zmcertmgr [options]

====Description====
{|style="width:100%" border="1" cellpadding="5" cellspacing="0"
! align="left" bgcolor="tan" |Name
! align="left" bgcolor="tan"|Description
|-
! colspan="2" align="left" bgcolor="wheat" |General Options
|-
|style="background=white" |<nowiki>-help</nowiki>
|Displays usage options for '''zmcertmgr'''
|-
! colspan="2" align="left" bgcolor="wheat" |Self-Signed Certificate Options
|-
|createca [-new]
|Generates a Certificate Authority (CA). The '''-new''' option forces the generation of a new CA.
|-
|deployca
|Deploys a CA.
|-
|createcsr <nowiki><self|comm> [-new] [-subject subject] [-subjectAltNames "host1,host2"]</nowiki>
|Creates a certificate signing request (CSR) for either a self or commercially signed certificate authority.  The '''<nowiki>-new</nowiki>''' option forces the generation of a new CSR. The '''<nowiki>-subject</nowiki>''' option allows you to specify the path in which the certificate is valid. The '''<nowiki>-subjectAltNames</nowiki>''' option allows you to specify additional hosts that may use the certificate other than the one listed in the subject.  The default subject is "/C=US/ST=N\/A/L=N\/A/O=Zimbra Collaboration Suite/OU=Zimbra Collaboration Suite/CN=${zimbra_server_hostname}".
|-
|createcrt [-new] [-days validation days] [-subject subject] [-subjectAltNames "host1,host2"]
|Creates a self-signed certificate based on the CSR generated using '''createcsr'''. The '''-new''' option forces the generation of a new certificate.  The '''-days''' option assigns a number of days for which the certificate is valid.  The '''-subject''' option allows you to specify the path in which the certificate is valid.  The '''-subjectAltNames''' allows you to specify additional hosts that may use the certificate other than the one listed  in the subject.  The default subject is "/C=US/ST=N\/A/L=N\/A/O=Zimbra Collaboration Suite/OU=Zimbra Collaboration Suite/CN=${zimbra_server_hostname}".
|-
|deploycrt <self>
|Deploys a self-signed certificate.
|-
! colspan="2" align="left" bgcolor="wheat" |Self-Signed and Commercial Certificate Options
|-
|deploycrt <comm> [certfile] [ca_chain_file]
|Deploys a commercial certificate.  Specify the certificate file and the certificate authority (CA) chain file.
|-
|savecrt
|Saves a certificate
|-
|viewcsr <nowiki><self|comm></nowiki> [csr_file]
|Shows a certificate signing request (CSR). Specify '''self''' if the CSR is self-signed. Specify '''comm''' if the certificate is commercial. Specify the CSR file to view.
|-
|viewdeployedcrt <nowiki>[all|ldap|mta|proxy|mailboxd]</nowiki>
|Shows a deployed certificate. This option only works for the local server.
|-
|viewstagedcrt <nowiki><self|comm></nowiki> [certfile]
|Shows a staged certificate. A staged certificate is placed in a staging file, where all files that will be deployed with the certificate are kept. You can use the staging area to verify that you are ready to deploy a certificate.  Specify '''self''' if the certificate is self-signed. Specify '''comm''' if the certificate is commercial.  Specify the certificate file to view.
|-
|verifycrt <nowiki><self|comm></nowiki> [priv_key] [certfile]
|Verifies a certificate. Specify '''self''' if the certificate is self-signed. Specify '''comm''' if the certificate is commercial. Specify the certificate key. Specify the certificate file.
|-
|verifycrtchain <ca_file> <certfile>
|Verifies a certificate chain.  Specify '''self''' if the certificate is self-signed.  Specify '''comm''' if the certificate is commercial.  Specify the certificate key.  Specify the certificate file. 
|}

====Examples====
The following are examples of using the above options for different installation scenarios.

=====Single-Node Self-Signed Certificate=====
1. Begin by generating a new Certificate Authority (CA).
  /opt/zimbra/bin/zmcertmgr createca -new
2. Then generate a certificate signed by the CA that expires in 365 days.
  /opt/zimbra/bin/zmcertmgr createcrt -new -days 365
3. Next deploy the certificate.
  /opt/zimbra/bin/zmcertmgr deploycrt self
4. Next deploy the CA.
  /opt/zimbra/bin/zmcertmgr deployca
5. To finish, verify the certificate was deployed to all the services.
  /opt/zimbra/bin/zmcertmgr viewdeployedcrt

=====Multi-Node Self-Signed Certificate=====
1. Begin by generating a new Certificate Authority (CA).
  /opt/zimbra/bin/zmcertmgr createca -new
2. Then generate a certificate signed by the CA that expires in 365 days with either wild-card or subject altnames.
  /opt/zimbra/bin/zmcertmgr createcrt -new -days 365 -subject "/C=US/ST=CA/L=NVA/O=ZCS/OU=ZCS/CN=*.domain.tld"
  /opt/zimbra/bin/zmcertmgr createcrt -new -days 365 -subjectAltNames "host1.domain.tld,host2.domain.tld"
3. Next, deploy the certificate to all nodes in the deployment.
  /opt/zimbra/bin/zmcertmgr deploycrt self -allserver
4. To finish, verify the certificate was deployed.
  /opt/zimbra/bin/zmcertmgr viewdeployedcrt
'''''Note''': The option '''viewdeployedcrt''' only works for the local server.''

=====Single-Node Commercial Certificate=====
1. Begin by generating a Certificate Signing Request (CSR).
  /opt/zimbra/bin/zmcertmgr createcsr comm -new -subject "/C=US/ST=CA/L=Sunnyvale/O=Yahoo/OU=Zimbra Collaboration Suite" -subjectAltNames host.example.com
2. Next, submit the CSR to the SSL provider and get a commercial certificate in PEM format. Save the new certificate to a temporary file (e.g. /tmp/commercial.crt).

3. Now, download and save the root Certificate Authority (CA) from your provider to a temporary file. (e.g. /tmp/ca.crt)

4. Download any intermediary CAs from your provider to a temporary file. (e.g. /tmp/ca_intermediary.crt)

5. Combine root and intermediary CAs into a temporary file.
  cat /tmp/ca.crt /tmp/ca_intermediary.crt > /tmp/ca_chain.crt
6. Verify your commercial certificate.
  /opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /tmp/commercial.crt /tmp/ca_chain.crt
  **Verifying /tmp/commercial.crt against
  /opt/zimbra/ssl/zimbra/commercial/commercial.key
  Certificate (/tmp/commercial.crt) and private key
  (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
  Valid Certificate: /tmp/commercial.crt: OK
7. Deploy your commercial certificate.
  /opt/zimbra/bin/zmcertmgr deploycrt comm /tmp/commercial.crt /tmp/ca_chain.crt
  ** Verifying /tmp/commercial.crt against
  /opt/zimbra/ssl/zimbra/commercial/commercial.key
  Certificate (/tmp/commercial.crt) and private key
  (/opt/zimbra/ssl/zimbra/commercial/commercial.key) match.
  Valid Certificate: /tmpt/commercial.crt: OK
  **Copying commercial.crt to /opt/zimbra/ssl/zimbra/commercial/commercial.crt
  **Appending ca chain /tmp/ca_chain.crt to
  /opt/zimbra/ssl/zimbra/commercial/commercial.crt
  **Saving server config key zimbraSSLCeretificate…done.
  **Saving server config key zimbraSSLPrivateKey…done.
  **Installing mta certificate and key…done.
  **Installing slapd certificate and key…done.
  **Installing proxy certificate and key…done.
  **Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12…done.
  **Creating keystore file /opt/zimbra/mailbox/etc/keystore…done.
  **Installing CA to /opt/zimbra/conf/ca…done.
8. To finish, verify the certificate was deployed.
  /opt/zimbra/bin/zmcertmgr viewdeployedcrt

==ZCS 4.5.x==
In ZCS 4.5.x, the task of creating a Certificate Authority, creating a self-signed certificate, and then installing the certificate is handled by three CLI commands. When you are installing a certificate, remember to stop and then restart Tomcat once the certificate has been installed.

===zmcreateca===
This command creates a Certificate Authority (CA).

====Syntax====
zmcreateca

===zmcreatecert===
This command creates a new self-signed certificate.

====Syntax====
zmcreatecert

===zmcertinstall===
This command installs a certificate.

'''''Note''': Tomcat must be stopped and restarted after you have installed a certificate.''

====Syntax====
zmcertinstall

===Example===
The follow example shows how to install a self-signed certificate on a ZCS 4.5.x server.

1. As root, type the follow commands.
  rm -rf /opt/zimbra/ssl
  mkdir /opt/zimbra/ssl
  chown zimbra:zimbra /opt/zimbra/ssl
2. Switch to the Zimbra User.
  su -zimbra
3. Type the following command.
  keytool -delete -alias my_ca -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit
4. Create the Certificate Authority.
  zmcreateca
5. Create the self-signed certificate.
  zmcreatecert
'''''Note:''' You may need to type '''zmcreatecert host.domain.com''' if your host uses multiple names or aliases. (For example, if you have the hostname '''bingo.insidedomain.com''', which is aliased to '''mail.truedomain.com''', you will want to include the host and domain name for your certificate.)  When typing your domain, be sure that the hostname is the one used in the certificate.''

6. Install your certificate.
  zmcertinstall mailbox
7. Stop Tomcat.
  tomcat stop
8. Restart Tomcat.
  tomcat start

[[Category:Administration]]
[[Category:Certificates]]
[[Category:Command Line Interface]]
[[Category:Troubleshooting Certificates]]