Zimbra

farrukhndm · #1 (**permalink**) 03-01-2011, 05:39 AM

From today morning i am facing given problem .

Code:

zmcontrol status
Unable to determine enabled services from ldap.
Enabled services read from cache. Service list may be inaccurate.
Host mail.mydomain.com
        antispam                Running
        antivirus               Running
        ldap                    Running
        logger                  Stopped
                zmlogswatchctl is not running
        mailbox                 Stopped
                zmmailboxdctl is not running.
        mta                     Running
        snmp                    Running
        spell                   Running
        stats                   Running

After Stop & start zmcontrol service

Code:

zmcontrol start
Host mail.mydomain.com
        Starting ldap...Done.
Unable to determine enabled services from ldap.
Enabled services read from cache. Service list may be inaccurate.
        Starting logger...Failed.
Starting logswatch...ERROR: service.FAILURE (system failure: ZimbraLdapContext) (cause: javax.net.ssl.SSLHandshakeException sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target)
zimbra logger service is not enabled!  failed.


        Starting mailbox...Done.
        Starting antispam...Done.
        Starting antivirus...Done.
        Starting snmp...Done.
        Starting spell...Done.
        Starting mta...Done.
        Starting stats...Done.

As its my production server, so please me to resolve the problem.

phoenix · #2 (**permalink**) 03-01-2011, 05:54 AM

The usual reason for this error, if you search the forums, is that your DNS A & MX records are non-existent or incorrect and/or you have an invalid /etc/hosts file. Search for the details of what information you need to check if the records are correct. You also need to look in the log files for any errors and give some information about what happened on your server at the time this problem occurred - did you reboot it, did you do any server updates, certificates expired etc., etc., etc.....?

farrukhndm · #3 (**permalink**) 03-01-2011, 06:28 AM

Thanks for reply ,but i solve this query by following the instructions in given link

Code:

http://www.zimbra.com/forums/administrators/45833-solved-zimbra-certificates-have-expired-i-m-having-difficulty-regenerating-them.html

What i find to make my zimbra up , by deleting old ssl/* ssl/.rnd and other as given below and make changing Certificate date from 365 to 3650...

Code:

################################################################################################################
# Regenerate SSL Cert
################################################################################################################
su - zimbra -c 'zmcontrol stop'
rm -rf /opt/zimbra/ssl/*
rm -rf /opt/zimbra/ssl/.rnd
/opt/zimbra/java/bin/keytool -delete -alias my_ca -keystore /opt/zimbra/java/jre/lib/security/cacerts -storepass changeit
/opt/zimbra/java/bin/keytool -delete -alias jetty -keystore /opt/zimbra/mailboxd/etc/keystore -storepass `su - zimbra -c 'zmlocalconfig -s -m nokey mailboxd_keystore_password'`
vi  /opt/zimbra/bin/zmcertmgr

# Find line 
# SUBJECT="/C=US/ST=N\/A/L=N\/A/O=Zimbra Collaboration Suite/OU=Zimbra Collaboration Suite/CN=${zimbra_server_hostname}" 
# and change to your company name

# then find and change you want value days expire cert validation_days=365 to validation_days=3650
# save /opt/zimbra/bin/zmcertmgr

/opt/zimbra/bin/zmcertmgr createca -new
/opt/zimbra/bin/zmcertmgr deployca -localonly
/opt/zimbra/bin/zmcertmgr createcrt self -new
/opt/zimbra/bin/zmcertmgr deploycrt self

su - zimbra -c 'zmcontrol start'

/opt/zimbra/bin/zmcertmgr deploycrt self
/opt/zimbra/bin/zmcertmgr deployca

su - zimbra -c 'zmupdateauthkeys'
/opt/zimbra/bin/zmcertmgr viewdeployedcrt

################################################################################################################

Proceeding above procedure

Code:

[zimbra@mail ~]$ zmcontrol status
Unable to determine enabled services from ldap.
Enabled services read from cache. Service list may be inaccurate.
Host mail.mydomain.com
        antispam                Stopped
                zmmtaconfigctl is not running
                zmamavisdctl is not running
        antivirus               Stopped
                zmmtaconfigctl is not running
                zmamavisdctl is not running
                zmclamdctl is not running
        ldap                    Stopped
        logger                  Stopped
                zmlogswatchctl is not running
        mailbox                 Stopped
                zmmtaconfigctl is not running.
                mysql.server is not running.
                zmmailboxdctl is not running.
        mta                     Stopped
                zmmtaconfigctl is not running
                postfix is not running
                zmsaslauthdctl is not running
        snmp                    Stopped
                zmswatch is not running.
        spell                   Stopped
                zmapachectl is not running
        stats                   Stopped
[zimbra@mail ~]$ exit
logout
[root@mail ~]# nano /opt/zimbra/bin/zmcertmgr
[root@mail ~]# nano /opt/zimbra/bin/zmcertmgr
[root@mail ~]# vi /opt/zimbra/bin/zmcertmgr
[root@mail ~]# /opt/zimbra/bin/zmcertmgr createca -new
** Creating directory /opt/zimbra/ssl/zimbra
** Creating directory /opt/zimbra/ssl/zimbra/ca
** Creating directory /opt/zimbra/ssl/zimbra/server
** Creating directory /opt/zimbra/ssl/zimbra/commercial
** Creating /opt/zimbra/ssl/zimbra/ca/zmssl.cnf...done
** Creating CA private key /opt/zimbra/ssl/zimbra/ca/ca.key...done.
** Creating CA cert /opt/zimbra/ssl/zimbra/ca/ca.pem...done.
[root@mail ~]# /opt/zimbra/bin/zmcertmgr deployca -localonly
** Importing CA /opt/zimbra/ssl/zimbra/ca/ca.pem into CACERTS...done.
** Copying CA to /opt/zimbra/conf/ca...done.
[root@mail ~]# /opt/zimbra/bin/zmcertmgr createcrt self -new
** Creating /opt/zimbra/conf/zmssl.cnf...done
** Backup /opt/zimbra/ssl/zimbra to /opt/zimbra/ssl/zimbra.20110301190739
** Retrieving server config key zimbraSSLCertificate...failed.
** Retrieving server config key zimbraSSLPrivateKey...failed.
** Generating a server csr for download self -keysize 1024
** Backup /opt/zimbra/ssl/zimbra to /opt/zimbra/ssl/zimbra.20110301190744
** Creating server cert request /opt/zimbra/ssl/zimbra/server/server.csr...done.
** Saving server config key zimbraSSLPrivateKey...failed.
** Signing cert request /opt/zimbra/ssl/zimbra/server/server.csr...done.
[root@mail ~]# /opt/zimbra/bin/zmcertmgr deploycrt self
** Saving server config key zimbraSSLCertificate...failed.
** Saving server config key zimbraSSLPrivateKey...failed.
** Installing mta certificate and key...done.
** Installing slapd certificate and key...done.
** Installing proxy certificate and key...done.
** Creating pkcs12 file /opt/zimbra/ssl/zimbra/jetty.pkcs12...done.
** Creating keystore file /opt/zimbra/mailboxd/etc/keystore...done.
** Installing CA to /opt/zimbra/conf/ca...done.
[root@mail ~]#
[root@mail ~]# su - zimbra -c 'zmcontrol start'
Host mail.mydomain.com
        Starting ldap...Done.
        Starting logger...Done.
        Starting mailbox...Done.
        Starting antispam...Done.
        Starting antivirus...Done.
        Starting snmp...Done.
        Starting spell...Done.
        Starting mta...Done.
        Starting stats...Done.

Happy to got solutions,But one thing that pinch me,its take 8 Hours to find the solutions.we are in the period of Cloud computing.Please guide us how to minimize production server downtime.

nahuelon · #4 (**permalink**) 06-18-2011, 08:42 AM

The "Regenerate SSL Cert" script works perfect for me. I'he got the Zimbra back to work. Thank you very much.

ericortego · #5 (**permalink**) 08-17-2011, 04:33 PM

I've been fighting with this error for several days now. None of these fixes seem to help. As best I can tell the problem seems to be somewhere in the config of the master. I set up a test network with the exact same settings as my production environment and everything works. But when I try to install a fresh ldap slave pointing it at our production server, which has gone though many upgrades progressing from 4 up to the current 7.1.2, I get many problems all seemingly related to

slap_client_connect: ..blah... Error, ldap_start_tls failed (-11)

The slave server does seem to sync and I can do TLS searches from it to the master, so Im just stumped. I'll probably open a support ticket in the morning If I don't kill myself with whiskey tonight.