[SOLVED] 6.0.1OSE error regenerting self-signed certs

[jrv]

6.0.1 OSE

My self-signed certificates will expire this week. As per the 6.0.2 release notes (page 24) I tried to regenerate them but got an error. Any suggestions?

root@zimbra:~/bin# zmcertmgr createca -new 
** Creating /opt/zimbra/ssl/zimbra/ca/zmssl.cnf...done
** Creating CA private key /opt/zimbra/ssl/zimbra/ca/ca.key...done.
** Creating CA cert /opt/zimbra/ssl/zimbra/ca/ca.pem...done.
root@zimbra:~/bin# zmcertmgr deployca
** Importing CA /opt/zimbra/ssl/zimbra/ca/ca.pem into CACERTS...done.
** Saving global config key zimbraCertAuthorityCertSelfSigned...failed.
** Saving global config key zimbraCertAuthorityKeySelfSigned...failed.
** Copying CA to /opt/zimbra/conf/ca...done.

[ArcaneMagus]

If you can log into the admin console interface have you tried regenerating the certificates there?

[jrv]

No, I cannot generate them from the admin console at this point. I get a server error, nad the error is too large for the Detail box (zmcertmgr failed)

[ArcaneMagus]

Are there any relevant lines in /var/log/zimbra.log or /opt/zimbra/log/mailbox.log?

[jrv]

Nothing I saw. However it's working now.

I tried it again from the command line, this time with Zimbra running, and got not errors. But, no new cert on reboot. However, the GUI ran, wand after that & a reboot I did have updated certs. So all is well now.

The "upgrading" guide might be changed to emphasize the GUI as the preferred way to regenerate certs.

Thanks!