SMTP SSL cert error: not trusted by the trust provider.

[kevinpaz]

I have installed a Geotrust cert in a Zimbra 4.5.9 open source install.

I followed these instructions:
Commercial Certificates - Zimbra :: Wiki
And then i followed steps 3 and 4 here:
Commercial Certificates - Zimbra :: Wiki

...but in Outlook I get the error:

The server you are connected to is using a security certificate that could not be verified.
A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Do you want to continue using this server?

In Mac mail.app it won't connect at all.

After reading around I tried this command with no luck:
/opt/zimbra/bin/postconf -e 'smtpd_tls_CAfile = /opt/zimbra/ssl/ssl/geotrust.crt'


Any ideas?


Thanks,
Kevin

[Klug]

You should try to import the SSL certificate manually (using a browser for example) into the client computers.

[dwmtractor]

You should try to import the SSL certificate manually (using a browser for example) into the client computers.

And if you're one of the unlucky ones doing this in Vista, it gets even more fun. Importing certs. is a whole lot more complicated on Vista than on older versions of Windows, I just discovered yesterday.

First you have to go into the "content" tab of internet options and tell Windows that your site is a trusted site. If you don't do this, the option for importing the certificate doesn't even show up when you view the certificate. Next you have to go to the website (you may have to close & reopen IE 7 first), and when it comes up with the certificate error, you choose to view the certificate. Then you have to import the certificate, not to the default location, but to the "Trusted Root Certification Authorities" store. Otherwise you'll keep getting the errors.

[kevinpaz]

Thanks for the replies but the reason I bought a cert from Geotrust is so that users wouldn't have to muck around with this stuff.

I ended up fixing it by appending the geotrust pem crt (downloaded from their site) to the end of my my.crt file.

Zimbra really needs to get a handle on this - the complexity involved in adding a third party cert is completely unheard of among competing packages.

[jholder]

Bug 18479 - Add an admin ext to allow user to manage the certificates for ZCS