Commercial Cert for Zimbra Web

[mwyant]

All right, as per the instructions here:
Commercial Certificates - ZimbraWiki

I have acquired a Commercial Cert and have been trying to install it using the same instructions. When I was shipped the cert, I received MAIL.SERVER.COM.crt and MAIL.SERVER.COM.der files. On my first try, I used the crt and got the following error:
[zimbra@tegu ssl]$ keytool -import -alias tomcat -keystore /opt/zimbra/ssl/ssl/commercial.keystore -trustcacerts -file MAIL.SERVER.COM.crt -storepass zimbra
keytool error: java.lang.Exception: Failed to establish chain from reply

After this, I shrugged off the error and completed step C. I got a certificate installed, but it wasn't showing as having been signed by any CA and did not resolve the self-signed cert issue.

So I repeated this process with the .der file and got this message:
[zimbra@tegu ssl]$ keytool -import -alias tomcat -keystore /opt/zimbra/ssl/ssl/commercial.keystore -trustcacerts -file MAIL.LINDEGROUP.COM.der -storepass zimbra
keytool error: java.lang.Exception: Failed to establish chain from reply

lo-and-behold, it's the same message! This time I did not follow through.

I don't see any reference to this problem anywhere and am a tad bit confused. Does anyone have any guidance?

My exact ZCS version is posted in the top right.

Thanks,
Mike

[jholder]

Import all of the certs that came with your cert.
Is this godaddy?

Just give them different aliases, like tomcat2

eg
keytool -import -alias tomcat2 blah blah

[mwyant]

Is there a specific order I should go in here?

The CA is actually NetworkSolutions

I received:
AddTrustExternalRoot.crt
MAIL.SERVER.COM.crt
MAIL.SERVER.COM.der
NetworkSolutions_CA.crt
UTNAddTrustServer_CA.crt

Thanks!

[jholder]

Well, you have to establish a trust chain. This usually because the vendor themselves aren't "trusted" so they have to establish a relationship with a trusted vendor.

Try this order:
AddTrustExternalRoot.crt
UTNAddTrustServer_CA.crt
NetworkSolutions_CA.crt
MAIL.SERVER.COM.crt

[mwyant]

Huh. I'm getting public key mismatch errors now. I guess I'll try and redownload these and see where that goes.

Thanks so far.