[SOLVED] Expired Cert in 5.0GA can cause mail Delivery failure

[Klug]

Thanks for the syntax.

Still not working (tried 3 times, double-checking the password each time and trying cut/paste too) :

[zimbra@zimbra-oss ~]$ ldapmodify -x -h localhost  -D "uid=zimbra,cn=admins,cn=zimbra" -W
Enter LDAP Password:
ldap_bind: Can't contact LDAP server (-1)

[quanah]

slapd doesn't listen on localhost. It must be the name of your host.

--Quanah

[Klug]

/me stupid

All done (steps a, b, c and d), no error.
Now restarting zimbra...

[Klug]

Still not working, same error in zimbra.log

[quanah]

What is the output of (running as zimbra)

ldapsearch -x -ZZ -h "FQDN" -b "" -s base

And it must be the fully qualified name of the host (FQDN).

--Quanah

[jholder]

Move the stuff in /opt/zimbra/ssl to a temp directory, and rerun the commands.

[Klug]

Originally Posted by quanah

What is the output of (running as zimbra)

ldapsearch -x -ZZ -h "FQDN" -b "" -s base

It says :

$ ldapsearch -x -ZZ -h "zimbra-oss.network-studio.com" -b "" -s base
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: ALL
#

#
dn:
objectClass: top
objectClass: OpenLDAProotDSE

# search result
search: 3
result: 0 Success

# numResponses: 2
# numEntries: 1

[Klug]

Originally Posted by jholder

Move the stuff in /opt/zimbra/ssl to a temp directory, and rerun the commands.

That fixed it 8)

We moved everything elsewhere except ca.csr (we tried without the old file and it did not work), steps a to d and it works.

There might be a problem with zmcertmgr : the /opt/zimbra/ssl/zimbra/ca/ca.pem file showed the correct hour (when I modified it) but what was inside is wrong :

# openssl x509 -in /opt/zimbra/ssl/zimbra/ca/ca.pem -noout -text
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 0 (0x0)
        Signature Algorithm: md5WithRSAEncryption
        Issuer: C=US, ST=N/A, L=N/A, O=Zimbra Collaboration Suite
        Validity
            Not Before: Sep 19 14:30:12 2006 GMT
            Not After : Sep 19 14:30:12 2007 GMT
  .....

Thank you so much for your help.

Should I open a bug ?

[quanah]

No, we are aware of the issue and there's already a bug on it. Glad it is working now!

--Quanah

[jholder]

Just to tie the loose ends up:
It appears that if you have an expired certificate, it can cause postfix to stop running. This will be fixed in 5.0.1

See bug: Bug 23253 - an expired CA cert will block mail delivery after upgrading to 5.0.0