[SOLVED] Expired Cert in 5.0GA can cause mail Delivery failure

[brwatters]

Any update on this TLS issue? .. Both our production server and test server have the same issue .. the fix was to set all YES to NO in the ldap cf files as stated in this last posting .. it seems this is something of a major bug .. how could all of the beta folks have not seen this and it get passed to GA ??

BRW

[jholder]

Yeah, it caught us by surprise as well.

The fix for this and the commercial cert issue will be in 5.0.1 which is set to be released really really soon. Can't give an exact date, but soon

[brwatters]

THanks for the update .. it sure freaked us out after the update appeared to go well but then ZERO email in/out ..

Hope to see 5.0.1 soon

BRW

[PhishKiller]

Originally Posted by brwatters

THanks for the update .. it sure freaked us out after the update appeared to go well but then ZERO email in/out ..

Hope to see 5.0.1 soon

BRW

Yes, we experienced the same panic. The main bug that GA was going to address for us worked wonderfully.. and honestly.. I did not do much more testing until I saw a flurry of bounces from another of our mail servers.

Caveat constructum.

[gwjones]

We encountered this same problem and after reading through this thread, I applied the suggested steps (including the additional steps of disabling tls) and yet the error still occurred. We just figured out that it is related to shared calendars. If shared calendars are enabled, the same error about an expired certificate occurs, but if the shared calendars are unchecked, the error goes away. Does anyone have an idea of where this could be originating? And hopefully, the 5.0.1 fix will catch this aspect as well. Thanks.

[gwjones]

Just to follow up to my own post:

This problem was resolved by Zimbra Support. In addition to the certificate files, Sun java keeps certificates in a keystore file. Here is the solution as received from support:

The keystore showed still the old certificate entry for tomcat now that we have moved to jetty

keytool -list -keystore /opt/zimbra/mailboxd/etc/keystore -storepass `zmlocalconfig -s -m nokey mailboxd_keystore_password`

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

jetty, Jan 8, 2008 , PrivateKeyEntry,
Certificate fingerprint (MD5): xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
tomcat, Jun 5, 2006 , PrivateKeyEntry,
Certificate fingerprint (MD5): xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx

Deleted tomcat alias with

keytool -delete -alias tomcat -keystore /opt/zimbra/mailboxd/etc/keystore -storepass `zmlocalconfig -s -m nokey mailboxd_keystore_password`

zmcontrol stop
zmcontrol start

Hopefully, this will help someone else with similar problems.

Wendell

[tolenaars]

Originally Posted by gwjones

Just to follow up to my own post:
Deleted tomcat alias with

keytool -delete -alias tomcat -keystore /opt/zimbra/mailboxd/etc/keystore -storepass `zmlocalconfig -s -m nokey mailboxd_keystore_password`

zmcontrol stop
zmcontrol start

Wendell

Thanx Wendell, this post saved my but bigtime today, since for some reasons we kept getting internal errors with shared calendars rendering our planning departments powerless to function.

John Tolenaars

[ArcaneMagus]

Originally Posted by gwjones

... In addition to the certificate files, Sun java keeps certificates in a keystore file....

Hmm the output I receive from that command is the following:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

tomcat, Feb 16, 2007, PrivateKeyEntry,
Certificate fingerprint (MD5): 19:44:7D:E8:A8:D8:19:90:39:42:E8:AF:D2:3E:AA:25

Is this a problem in any way? I seem to be missing the jetty keystore entirely.

[bramm]

I think I'm encountering the same problem with 5.0.1 NE. After a clean install I have requested a commercial certificate. I installed it trough the web interface without any problems.

But after this action the servers stops sending and receiving mail. The log file is flooded with messages like Unable to set STARTTLS.

What should I do? When I use the command as above I get back that there is 1 entry in my keystore, jetty. I hope someone can assist me.

[bramm]

Originally Posted by bramm

I think I'm encountering the same problem with 5.0.1 NE. After a clean install I have requested a commercial certificate. I installed it trough the web interface without any problems.

But after this action the servers stops sending and receiving mail. The log file is flooded with messages like Unable to set STARTTLS.

What should I do? When I use the command as above I get back that there is 1 entry in my keystore, jetty. I hope someone can assist me.

I have edited the ldap files not to load the tls as stated above. So everything works now, but this is not the right way to go I think. I assume that a commercial certificate should be installed correctly when using the web interface.

I'm using ubuntu and the corresponding version.