I gave up and reinstalled Zimbra. Interestingly, when I updated the certificate to a 10-year certificate from the default of 1 year, I got exactly the same error messages getting and setting the server config keys. Not sure what that's going to do to me a year from now.