I have to admit, I am new to Zimbra. I have installed ZCS 6.0.6 on RHE 5. I could not get a self-assigned ssl cert to authenticate, since my Zimbra server has an Internal domain name and the FQDN is an external IP forwarding address.

I decided to try a GeoCert ssl. I created an ssl csr using:
/opt/zimbra/bin/zmcertmgr createcsr comm -new -keysize 2048 "/CN=external FQDN/C=XX/ST=XX/L=XX/O=XX/OU=Zimbra Collaboration" -subjectAltNames "Internal Name"

GeoCert liked the .csr, and generated the keys.

I have used the zimbraAdmin and the command line tools, and both give me errors of keys not matching. If I try without -keysize, zimbraAdmin reports that there is no keysize.