 I lied
Wrong keystore for the ca - that's in /opt/zimbra/java/jre/lib/security/cacerts...
keytool -list -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit
keytool -delete -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit -alias my_ca |