New Mailbox - LDAP Cert Problems

[Chewie71]

Hi,

Multi-node setup. I'm bringing a new mailbox server online and have installed Zimbra and added it to the existing Zimbra multi-node setup. However it won't start Zimbra...

$ zmcontrol start
Host zcs-mb01.wiu.edu
Unable to determine enabled services from ldap.
Unable to determine enabled services. Cache is out of date or doesn't exist.

This seems to be related to a cert problem on LDAP. But the cert there is good...

# /opt/zimbra/bin/zmcertmgr viewdeployedcrt ldap | grep not
notBefore=Dec 22 02:40:56 2012 GMT
notAfter=Dec 22 02:40:56 2013 GMT

However that doesn't match the cert that the new mailbox thinks it has...

# /opt/zimbra/bin/zmcertmgr viewdeployedcrt ldap | grep not
notBefore=Mar 15 15:30:09 2013 GMT
notAfter=Mar 15 15:30:09 2014 GMT

When I tried to deploycrt from the LDAP server to the new mailbox, the new mailbox prompted me for the Zimbra password, which there isn't one and which none of the other systems asked for....

# /opt/zimbra/bin/zmcertmgr deploycrt self -allserver
Warning: Permanently added 'zcs-mb01.wiu.edu,10.50.102.101' (RSA) to the list of known hosts.
zimbra@zcs-mb01.wiu.edu's password:

So I'm not sure what I'm missing here. Any ideas?

Thanks,
Matt

[Chewie71]

This command on the new mailbox server fails...

# /opt/zimbra/bin/zmcertmgr getcrt self -allserver
** Retrieving global config key zimbraSSLCertificate...failed.
** Retrieving global config key zimbraSSLPrivateKey...failed.

[Chewie71]

Looks like this setting is the culprit....

zmlocalconfig -e ssl_allow_untrusted_certs=true

Setting that to true allowed me to do the getcrt command and then rerun /opt/zimbra/libexec/zmsetup.pl

Did I miss a configuration option during the install where I could have set that zmlocalconfig parameter?