4.0 RC1 Documents initialization failed on upgrade

[neilmc]

Installed on Debian 3.1

Wondering if anyone else ran into this.

At the end of the upgrade after starting the servers, I saw "installing documents"

then something like error initializing documents, install documents failed.

From the zmsetup log, it seems to be related to SSL (section of log below)

Thinking that creating a new document in the Admin panel might cause documnets to initialize. I created wiki@domain & enabled the feature.

Now when I open the domain in the Admin Panel it immediately pops up an error "Account does not exist" Looking at the details of this error it says "Account wiki@domain does not exist"

and then several service exception messages about the missing account.

Anyone have a solution? Is this something to submit to the bug tracker or just something borked on my system?

Initializing Documents...
*** Running as zimbra user: /opt/zimbra/bin/zmprov mc default zimbraFeatureNotebookEnabled TRUE

[] ERROR: java.security.cert.CertificateExpiredException: NotAfter: Mon Jul 03 02:04:38 EST 2006
ERROR: zclient.IO_ERROR (invoke java.security.cert.CertificateException: Untrusted Server Certificate Chain, server: localhost) (cause: javax.net.ssl.SSLHandshakeException java.security.cert.CertificateException: Untrusted Server Certificate Chain)
*** Running as zimbra user: /opt/zimbra/bin/zmprov mcf zimbraNotebookAccount fepwi8hkzh@mail.mdgp.net.au

[] ERROR: java.security.cert.CertificateExpiredException: NotAfter: Mon Jul 03 02:04:38 EST 2006
ERROR: zclient.IO_ERROR (invoke java.security.cert.CertificateException: Untrusted Server Certificate Chain, server: localhost) (cause: javax.net.ssl.SSLHandshakeException java.security.cert.CertificateException: Untrusted Server Certificate Chain)
*** Running as zimbra user: /opt/zimbra/bin/zmprov in fepwi8hkzh@mail.mdgp.net.au '5TPU.owR' /opt/zimbra/wiki/Template Template

[] ERROR: java.security.cert.CertificateExpiredException: NotAfter: Mon Jul 03 02:04:38 EST 2006
ERROR: zclient.IO_ERROR (invoke java.security.cert.CertificateException: Untrusted Server Certificate Chain, server: localhost) (cause: javax.net.ssl.SSLHandshakeException java.security.cert.CertificateException: Untrusted Server Certificate Chain)
failed to initialize documents...see logfile for details.

*** Running as zimbra user: /opt/zimbra/bin/zmprov -l mc default zimbraFeatureNotebookEnabled FALSE


>>>>> Sorry this probably belongs in the installation forum

[schemers]

The error:

[] ERROR: java.security.cert.CertificateExpiredException: NotAfter: Mon Jul 03 02:04:38 EST 2006
ERROR: zclient.IO_ERROR (invoke java.security.cert.CertificateException: Untrusted Server Certificate Chain, server: localhost) (cause: javax.net.ssl.SSLHandshakeException java.security.cert.CertificateException: Untrusted Server Certificate Chain)

Means your certifcate for localhost has expired, as zmprov now uses SOAP via SSL to provision accounts by default. If you add "-l" ("use ldap") to the zmprov command it should work.

Ultimately you should regenerate the self-signed certificate (there was a bug in the script that generated the self-signed cert that caused it to generate a cert that was only good for 60 days, IIRC) so zmprov can talk to the server via SOAP instead of directly modifying LDAP, which bypasses a cache kept within Tomcat.

[neilmc]

Originally Posted by schemers

The error:

[] ERROR: java.security.cert.CertificateExpiredException: NotAfter: Mon Jul 03 02:04:38 EST 2006
ERROR: zclient.IO_ERROR (invoke java.security.cert.CertificateException: Untrusted Server Certificate Chain, server: localhost) (cause: javax.net.ssl.SSLHandshakeException java.security.cert.CertificateException: Untrusted Server Certificate Chain)

Means your certifcate for localhost has expired, as zmprov now uses SOAP via SSL to provision accounts by default. If you add "-l" ("use ldap") to the zmprov command it should work.

Ultimately you should regenerate the self-signed certificate (there was a bug in the script that generated the self-signed cert that caused it to generate a cert that was only good for 60 days, IIRC) so zmprov can talk to the server via SOAP instead of directly modifying LDAP, which bypasses a cache kept within Tomcat.

Thanks schemers. I'll try regenerating the ssl cert tonight and try again. I imagine that I can do something with zmprov to get rid of the partly created dead duck wiki@hostname that is in the Admin panel right now?

At the moment the "create documents" button is unavailable. After getting past the error that wiki@hostname doesn't exist, the documents admin panel has a box with wiki and to the right of it the domain dropdown.

[JLee]

The Notebook app is a "technology preview" for this release, and will be disabled by default. If you wish to try out Notebook, first make sure you have generated a new SSL cert for your tomcat, set zimbraFeatureNotebookEnabled to TRUE in cos (zmprov mc), then re-initialize Notebook app via `zmprov in <yourwikiacct>@<yourdomain> <password> /opt/zimbra/wiki/Template Template`.

[czaveri]

I upgraded one of the systems from ZCS 3.1.4 to ZCS 4.0.0 GA and faced an exact problem - CertificateExpiredException and dead duck and all.

I could create a domain-level wiki - wiki@domain.com but it so happs that when a user goes to his personal notebook he gets:

Error: Document templates missing. Please notify administrator.

I presume that this error will go away when I run:

zmprov in <yourwikiacct>@<yourdomain> <password> /opt/zimbra/wiki/Template Template

Am I right? If this is the way then how do I create templates for every user on the domain? I don't have everyone's password.

[czaveri]

Got it!

Cache problem! cleared!

Cleaned the Cache - Restarted the Browser.

[PNE]

Just now I have the same problem when upgrading from 3.1.2 to 4.0.2 GA. Only difference is that I have previously installed another certificate from our company CA so that all company computers trust it by default. It is just like the commercial certificate, but with limited trust. Of course I want to stay with it.

Now I wonder what should I do - recreate/reinstall certificate from company CA, or self signed certificate?

[phoenix]

Do a recreate/reinstall from your company CA, that should do it.

[PNE]

Just to be sure, because I just don't get it:

What certificate is really needed to fix this? The certificate issued by our company CA is not expired. When I access zimbra, there is no sign of problems with certificate/SSL, it works. So how could it help if I recreated and reinstall it? Or I must recreate the self signed certificate? Any help is appreciated.

Attached is Zimbra 4.0.2 install log.

[phoenix]

Originally Posted by PNE

Just to be sure, because I just don't get it:.

I'm not surprised, that should have read the self-signed certificate. Sorry about that.