Accessing external accounts from Zimbra

[beli.sk]

Hi there,

I came across a problem that when a user tries to add an external account with SSL IMAP connection in his Preferences - Accounts settings, the connection test fails with some cryptic message. In the mailbox.log I found more hints:

...
Code:service.FAILURE
        at com.zimbra.common.service.ServiceException.FAILURE(ServiceException.java:248)
...
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: [the remote server cert info]
...
Caused by: java.security.cert.CertificateException: [the remote server cert info]
        at com.zimbra.common.net.CustomTrustManager.checkServerTrusted(CustomTrustManager.java:90)
...

Looks like the remote server's cert is considered untrusted and the connection fails. The server uses a cert signed by a custom in-house CA. Is there a way to import this CA cert somewhere into Zimbra so it would consider this SSL IMAP connection trusted? Or (less prefered) is there a way to disable certificate validation for these types of connections?

Thank you for any replies. Have a nice day.

[Labsy]

If remote server FORCES SSL, then I hope someone will help you with the part of the question about importing cert to Zimbra. But if remote server does not force SSL, you may try without checking "SSL" option under external account and click on "Test".

[beli.sk]

Hi Labsy,
thanks for the tip, the server could accept a connection without SSL but it would go through the Internet and I'd rather not send my passwords unsecured.

[beli.sk]

This seems to be a general Zimbra SSL problem. It also affects the migration wizard in the admin console, when I try to migrate from "generic IMAP server", in the mailbox log I see the same errors about invalid certificate and the migration fails

Is there any way to solve this? i.e. make Zimbra accept the SSL certificate of the remote IMAP server?

[mishka]

I have exactly the same problem under the 7.1.0 Release. I tried to set the data_source_trust_self_signed_certs entry to true via zmlocalconfig as said elsewhere but nothing happens, even if I restart the server.

Is this a known bug and are some people working on it ?