Zimbra Hates GoDaddy

[frisi]

we had troubles installing the godaddy certificate on our zimbra server too.
finally we found out that its enough to just add the "tomcat" alias to your keystore.
it needs to contain a combined certificate:

cat <your-ssl-cert.crt> gd_intermediate.crt gd_cross_intermediate.crt > all.crt

i've posted all the details on my blog: Installing a GoDaddy certificate on Zimbra | Webmeisterei GmbH

[warmbowski]

No, I didn't ask for www.mail.mydomain.com either...

If you read the fine print, it says that godaddy automatically does this for you when you don't specify the alt name - gee thanks godaddy!

[moquist]

I'm running Zimbra 5.0 on Ubuntu Dapper.

I used the Admin Console to generate a CSR, sent that off to go-daddy, and got my CRT back. I don't have four files, or even three. I only have two:
myserver.com.crt
gd_intermediate_bundle.crt

The GUI wants me to submit a "Certificate", a "Root CA", and an "Intermediate CA".

The "Certificate" is, I assume, myserver.com.crt.

The "Intermedia CA" is, I presume, gd_intermediate_bundle.crt.

But what is "Root CA"?

I've tried various combinations of catting these two together and swapping around what gets uploaded into which box, but to no avail. I always get this:
Message: Your certificate was not installed due to the error : system failure: XXXXX ERROR: Invalid Certificate: Error code: ZaCertWizard.prototype.installCallback Method: AjxException.UNKNOWN_ERROR Details:system failure: XXXXX ERROR: Invalid Certificate:

I'll appreciate help to get this working.

[warmbowski]

@moquist

Here is the repository where you need to download the root cert (gd-class2-root.crt):
https://certs.godaddy.com/Repository.go

You are on the right track otherwise.

See this thread for more info:
Trying to install QuickSSL certificate without any luck

[SpEnTBoY]

Ok I STILL can't get my crt loaded and it's driving me nuts.

First I went to GoDaddy and paid for the cert.

Then:
1. Generated the CSR through the admin GUI
2. Submitted the CSR to GD
3. Downloaded the provided files:
gd_intermediate_bundle.crt mail.bangtherockstogether.net.crt
(gd_intermediate_bundle being the GD provided concatinated crt)
4. Verified that the CSR info matched what the cert was being issued for

Ok something odd although I'm not sure it's a show stopper ... on GoDaddy I see this:
"Organization Unit Domain Control Validated"

but on my server when I generated the CSR, I didn't specify an OU. Then I generated a NEW CSR using 'Domain Control Validated' as the OU just in case this is why it isn't validating the cert. When viewing the current CSR from the admin GUI it still shows no OU and I still get the damn invalid certificate error????

Does anyone have a solid solution?? I've hunted the forums and it all sounds familiar but from what I can tell I'm doing what anyone who's had it work has done

[SpEnTBoY]

I reverted to THIS and everything worked fine ... not sure why the wizzard hated me

[mmorse]

Don't worry it doesn't - you might have just hit this bug: http://www.zimbra.com/forums/adminis...html#post95454 (workarounds listed)

[shairozan]

I purchased my ssl certs from godaddy.com yesterday, and am running into a remarkably annoying problem. Following a post I found on here, I have tried everything, but no matter what I always get the "unmatching certificate and private key" the first time I try to upload the certs.

Then the second time I try any combination, I get a series of other errors, so long the detail window can't even display them. I saw someone in the forums say "Re generate the CSV and re key the certificate." I have done that three times today, and still have not been able to get anything to work.

Is there anyone who can help me?

[swu]

What steps do I need to take when renewing my SSL cert from Godaddy? I requested my renewal cert using the same CSR and have that in hand.

Can I do this from the Admin GUI, is renewing a cert different from installing a new one?

Thanks in advance for any wisdom here...