When you install Zimbra on a server behind NAT, your public IP is not configured in the server, instead, it gets routed to the server using NAT gateway. Zimbra wants the IP address of your MX record present in the server.
To solve this problem, we can use Split DNS. When you check the IP of the MX record from the server, it resolves to the internal IP address of the server. For everyone else, the MX record resolves to the public IP Address of the server.
IMPORTANT: Do not install Zimbra dnscache (unbound) as it listens on port 53, which will cause conflict with Split DNS.
Disable systemd-resolved
On Ubuntu, local DNS resolving is done by systemd-resolved, you need it disabled.
systemctl disable systemd-resolved.service
systemctl stop systemd-resolved
rm -f /etc/resolv.conf
tee /etc/resolv.conf << END
nameserver 127.0.0.1
END
On the Dashboard, you will see the Zimbra version displayed. On the right top side, you will see the “Help” menu. Click on it, then select “About Zimbra”, this will show a popup with the Zimbra version and the build and release date.
On Zimbra mail server, webmail stopped working on Port 80/443. Admin interface worked properly on url https://hostname:7071/. There is no errors displayed under monitor tab of Zimbra Admin.
To fix, run
su - zimbra
zmprov ms `zmhostname` zimbraReverseProxySSLToUpstreamEnabled FALSE
zmprov ms `zmhostname` zimbraMailMode both
zmprov ms `zmhostname` zimbraReverseProxyMailMode both
./libexec/zmproxyconfig -e -w -o -a 8080:80:8443:443 -x both -H `zmhostname`
zmcontrol restart
After running this, netstat -lntp start showing nginx running on port 80 and 443
On installing SSL on the Zimbra mail server, i get the following error
zimbra@zim:~/boby$ /opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/zimbra/boby/zim_simplecloud_co_za.crt
** Verifying '/opt/zimbra/boby/zim_simplecloud_co_za.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial.key'
Certificate '/opt/zimbra/boby/zim_simplecloud_co_za.crt' and private key '/opt/zimbra/ssl/zimbra/commercial/commercial.key' match.
** Verifying '/opt/zimbra/boby/zim_simplecloud_co_za.crt' against '/opt/zimbra/ssl/zimbra/commercial/commercial_ca.crt'
ERROR: Unable to validate certificate chain: /opt/zimbra/boby/zim_simplecloud_co_za.crt: C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
error 2 at 2 depth lookup:unable to get issuer certificate
zimbra@zim:~/boby$
This was due to SSL cert chain. The ca-bundle file they provided did not work with Zimbra. This is due to some issue with the order in which CA Certificate files are placed. Here is Zimba documentation related to this issue
I checked with SSL provider, and they initially provided a combined SSL certificate, that has cert file + ca certificate. I tried to install it, but it did not work.
After showing SSL support the screenshot of the SSL install page, they provided me with 3 different files.
In the zimbra SSL install, you have option to add more intermediate CA by clicking “Add Intermediate CA” link.
I have installed it on servers with 4 GB RAM without any problem. If you are installing on a server with 4 GB RAM, make sure you add swap in cause you run out of RAM.
cd /usr/local/src
wget https://files.zimbra.com/downloads/8.8.15_GA/zcs-8.8.15_GA_4179.UBUNTU20_64.20211118033954.tgz
tar xvf zcs-8.8.15_GA_4179.UBUNTU20_64.20211118033954.tgz
cd zcs-8.8.15_GA_4179.UBUNTU20_64.20211118033954
./install.sh
It will ask some questions. For most questions, you can just press enter as that is the default option (Y).
Once install is done, you will be asked to set an admin password.
After the installation is done, you will be able to login to the Zimbra Admin area at
