Huge problem after upgrade: TLS init def ctx failed: -1

[cdmdotnet]

Hi all.
I've just cleaned up the instructions just a little :
removing line breaks that shouldn't exist
replacing general instructions with commands
adding an additional permission change
and inclusing two points at which I got errors which meant the fix didn't work properly - the things marked /* ...... */

1. First stage

As root: IE sudo -i
tar cf /tmp/zimbra-ssl-bak.tar /opt/zimbra/ssl/
rm -rf /opt/zimbra/ssl/*
chown zimbra:zimbra /opt/zimbra/ssl
chown zimbra:zimbra /opt/zimbra/java/jre/lib/security/cacerts
chmod 644 /opt/zimbra/java/jre/lib/security/cacerts
chown zimbra:zimbra /opt/zimbra/mailboxd/etc/keystore

As zimbra: IE su zimbra
keytool -delete -alias my_ca -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit
keytool -delete -alias jetty -keystore /opt/zimbra/mailboxd/etc/keystore -storepass `zmlocalconfig -s -m nokey mailboxd_keystore_password`
/* Error here about permissions means this fix probably WONT work */

As root: IE sudo -i
/opt/zimbra/bin/zmcertmgr createca -new
/opt/zimbra/bin/zmcertmgr deployca -localonly
/opt/zimbra/bin/zmcertmgr createcrt self -new
/* an error here while retreiving the cert from the server then again, this fix most probably wont work */
/opt/zimbra/bin/zmcertmgr deploycrt self

As zimbra: IE su zimbra
zmcontrol stop
zmcontrol start


2. Second stage

As root: IE sudo -i
tar cf /tmp/zimbra-ca-bak.tar /opt/zimbra/conf/ca/
rm -rf /opt/zimbra/conf/ca/*
cp /opt/zimbra/ssl/zimbra/ca/ca.key /opt/zimbra/conf/ca/ca.key
cp /opt/zimbra/ssl/zimbra/ca/ca.pem /opt/zimbra/conf/ca/ca.pem
ln -f -s ca.pem /opt/zimbra/conf/ca/`openssl x509 -hash -noout -in /opt/zimbra/conf/ca/ca.pem`.0
chmod 644 /opt/zimbra/conf/ca/*

As zimbra: IE su zimbra
zmcontrol stop
zmcontrol start

[ljrand]

Originally Posted by cdmdotnet

2. Second stage

As root: IE sudo -i
tar cf /tmp/zimbra-ca-bak.tar /opt/zimbra/conf/ca/
rm -rf /opt/zimbra/conf/ca/*
cp /opt/zimbra/ssl/zimbra/ca/ca.key /opt/zimbra/conf/ca/ca.key
cp /opt/zimbra/ssl/zimbra/ca/ca.pem /opt/zimbra/conf/ca/ca.pem
ln -f -s ca.pem /opt/zimbra/conf/ca/`openssl x509 -hash -noout -in /opt/zimbra/conf/ca/ca.pem`.0
chmod 644 /opt/zimbra/conf/ca/*

Doesn't the last line above leave /opt/zimbra/conf/ca/ca.key world-readable when it should be chmod'ed to only 600?

[jdp459]

Whenever I see 'su zimbra' I wonder if that really should be 'su - zimbra' to get the zimbra environment variables?

[phoenix]

Originally Posted by jdp459

Whenever I see 'su zimbra' I wonder if that really should be 'su - zimbra' to get the zimbra environment variables?

It should always be 'su - zimbra', anything else can cause problems.

[wizpva]

Hello

Sorry for a poor english and thanks for your help.

We use the following Release :
Zimbra opensource release 6.0.4_GA_2038.SLES11_64_20091214184036
on a SLES11_64 FOSS edition

We haven't access to zimbra admin and need to recreate the certificate.
We found your post for a 5.0 release. We follow it but we meet problems :

antispam Running
antivirus Running
ldap Running
logger Running
mailbox Stopped
zmmailboxdctl is not running.
mta Running
snmp Running
spell Running
stats Running

and a zmprov give :

[] INFO: I/O exception (java.net.ConnectException) caught when processing request: Connection refused
[] INFO: Retrying request
ERROR: zclient.IO_ERROR (invoke Connection refused, server: localhost) (cause: java.net.ConnectException Connection refused)

Is there somebody who can help us.

Best regards

[jdp459]

We haven't migrated to 6.x yet, but looking at the message doesn't make me think it is a problem with the certificate at all. I could be wrong.

a) What makes you believe the cert needs to be regenerated? Is there a log entry with cert errors?
b) Why don't you have access to the admin GUI? You can reset the admin password from CLI and you can use ssh to forward ports through a firewall if necessary.
c) I hope you've already tried to restart Zimbra.
sudo /etc/init.d/zimbra restart

I haven't run SuSE in years, so that cmd could be off a little.

Whenever I see Zimbra connection errors, I have to think that it is a /etc/hosts or DNS issue first. Does the Zimbra server have access to it self using the FQN that Zimbra knows as itself?

To get better help, you'll need to attach the interesting parts from few logs from /opt/zimbra/log/ and /var/log/zimbra.log.

Lastly, I think the certificate handling in 6.x changed from what 5.x does. Did you read the wiki article on 6.x and certs? Here's a 5.x Problem with Certificate can cause MTA Failure - Zimbra :: Wiki article. Here's a forum thread on 6.x certs [SOLVED] Certificate problem with 6.0.5

I hope these questions don't send you in the wrong directions for the solution you need. Good luck!

BTW, your English is fine.