You can use the zmcertmgr command line utility to manage and install certificates. SSH access to the server will be needed for it. To use this tool, log in as root for Zimbra version prior to 8.7, or as the zimbra user for versions 8.7 and higher. Switch to root by running this command:
2. Verify that your certificate and private key match by using this command:/opt/zimbra/bin/zmcertmgr verifycrt comm /opt/zimbra/ssl/zimbra/commercial/commercial.key /opt/yourdomain_com.crt /opt/yourdomain_com.ca-bundle
Change defaults domain zimbra 8
Download Zip: https://byltly.com/2vzyW6
3. Deploy the certificate by running this command:/opt/zimbra/bin/zmcertmgr deploycrt comm /opt/yourdomain_com.crt /opt/yourdomain_com.ca-bundleFor successful execution, the output should look like this:
Note: if you did not generate the CSR on Zimbra, first place the private key for your certificate into the following directory: /opt/zimbra/ssl/zimbra/commercial/The private key file needs to be named commercial.key. If needed, replace the existing file.
The time between changes in the time-dependent portion of addressverification probe sender addresses. The time-dependent portion isappended to the localpart of the address specified with theaddress_verify_sender parameter. This feature is ignored when theprobe sender addresses is the null sender, i.e. the address_verify_sendervalue is empty or .
Where the Postfix SMTP client should deliver mail when it detectsa "mail loops back to myself" error condition. This happens whenthe local MTA is the best SMTP mail exchanger for a destinationnot listed in $mydestination, $inet_interfaces, $proxy_interfaces,$virtual_alias_domains, or $virtual_mailbox_domains. By default,the Postfix SMTP client returns such mail as undeliverable.
Enable interoperability with remote SMTP clients that implement an obsoleteversion of the AUTH command (RFC 4954). Examples of such clientsare MicroSoft Outlook Express version 4 and MicroSoft Exchangeversion 5.0.
If you use this feature, run "postmap /etc/postfix/canonical" tobuild the necessary DBM or DB file after every change. The changeswill become visible after a minute or so. Use "postfix reload"to eliminate the delay.
Starting with Postfix version 3.6, the compatibility level inthe above warning message is the Postfix version that introducedthe last incompatible change. The level is formatted asmajor.minor.patch, where patch is usually omitted anddefaults to zero. Earlier compatibility levels are 0, 1 and 2.
It changes the meaning of the corresponding per-destinationconcurrency limit, from concurrency of deliveries to the samedomain into concurrency of deliveries to the same recipient.Different recipients are delivered in parallel, subject to theprocess limits specified in master.cf.
It changes the meaning of the corresponding per-destinationrate delay, from the delay between deliveries to the samedomain into the delay between deliveries to the samerecipient. Again, different recipients are delivered in parallel,subject to the process limits specified in master.cf.
It changes the meaning of other corresponding per-destinationsettings in a similar manner, from settings for delivery to thesame domain into settings for delivery to the samerecipient. Use transport_destination_recipient_limit to specify atransport-specific override, where transport is the master.cfname of the message delivery transport.
Enable long, non-repeating, queue IDs (queue file names). Thebenefit of non-repeating names is simpler logfile analysis andeasier queue migration (there is no need to run "postsuper" tochange queue file names that don't match their message file inodenumber).
The mailq (postqueue -p) output has a wider Queue ID column.The number of whitespace-separated fields is not changed. The hash_queue_depth algorithm uses the first charactersof the queue file creation time in microseconds, after conversioninto hexadecimal representation. This produces the same queue hashingbehavior as if the queue file name was created with "enable_long_queue_ids= no".
This feature is available in Postfix 2.3 and later. With olderPostfix releases, the behavior is as if this parameter is set to"no". The old setting can be expensive with deeply nested aliasesor .forward files. When an alias or .forward file changes theDelivered-To: address, it ties up one queue file and one cleanupprocess instance while mail is being forwarded.
The list of environment variables that a privileged Postfixprocess will import from a non-Postfix parent process, or name=valueenvironment overrides. Unprivileged utilities will enforce thename=value overrides, but otherwise will not change their processenvironment. Examples of relevant environment variables:
The Postfix LMTP client time limit for completing a TCP connection, orzero (use the operating system built-in time limit). When noconnection can be made within the deadline, the LMTP client triesthe next address on the mail exchanger list.
Send an XFORWARD command to the remote LMTP server when the LMTP LHLOserver response announces XFORWARD support. This allows an lmtp(8)delivery agent, used for content filter message injection, toforward the name, address, protocol and HELO name of the originalclient to the content filter and downstream LMTP server.Before you change the value to yes, it is best to make sure thatyour content filter supports this command.
Optional list of name=value pairs that specify defaultvalues for arbitrary macros that Postfix may send to Milterapplications. These defaults are used when there is no correspondinginformation from the message delivery context.
The domain name that locally-posted mail appears to comefrom, and that locally posted mail is delivered to. The default,$myhostname, is adequate for small sites. If you run a domain withmultiple machines, you should (1) change this to $mydomain and (2)set up a domain-wide alias database that aliases each user touser@that.users.mailhost.
For maximal stability it is best to use a file that is readinto memory such as pcre:, regexp: or texthash: (texthash: is similarto hash:, except a) there is no need to run postmap(1) before thefile can be used, and b) texthash: does not detect changes afterthe file is read).
The group ownership of set-gid Postfix commands and of group-writablePostfix directories. When this parameter value is changed you needto re-run "postfix set-permissions" (with Postfix version 2.0 andearlier: "/etc/postfix/post-install set-permissions".
The location of Postfix dynamically-linked libraries(libpostfix-*.so), and the default location of Postfix databaseplugins (postfix-*.so) that have a relative pathname in thedynamicmaps.cf file. The shlib_directory parameter defaults to"no" when Postfix dynamically-linked libraries and database pluginsare disabled at compile time, otherwise it typically defaults to/usr/lib/postfix or /usr/local/lib/postfix.
The directory specified with shlib_directory should containonly Postfix-related files. Postfix dynamically-linked librariesand database plugins should not be installed in a "public" systemdirectory such as /usr/lib or /usr/local/lib. Linking Postfixdynamically-linked library files or database plugins into non-Postfixprograms is not supported. Postfix dynamically-linked librariesand database plugins implement a Postfix-internal API that changeswithout maintaining compatibility.
You can change the shlib_directory value after Postfix isbuilt. However, you may have to run ldconfig or equivalent to preventPostfix programs from failing because the libpostfix-*.so files arenot found. No ldconfig command is needed if you keep the libpostfix-*.sofiles in the compiled-in default $shlib_directory location.
When no connection can be made within the deadline, the PostfixSMTP clienttries the next address on the mail exchanger list. Specify 0 todisable the time limit (i.e. use whatever timeout is implemented bythe operating system).
The server hostname is matched against all names provided asdNSNames in the SubjectAlternativeName. If no dNSNames are specified,the CommonName is checked. The behavior may be changed with thesmtp_tls_enforce_peername option.
The maximal number of MX (mail exchanger) IP addresses that canresult from Postfix SMTP client mail exchanger lookups, or zero (nolimit). Prior toPostfix version 2.3, this limit was disabled by default.
An optional table to prevent repeated SASL authenticationfailures with the same remote SMTP server hostname, username andpassword. Each table (key, value) pair contains a server name, ausername and password, and the full server response. This informationis stored when a remote SMTP server rejects an authentication attemptwith a 535 reply code. As long as the smtp_sasl_password_mapsinformation does not change, and as long as the smtp_sasl_auth_cache_nameinformation does not expire (see smtp_sasl_auth_cache_time) thePostfix SMTP client avoids SASL authentication attempts with thesame server, username and password, and instead bounces or defersmail as controlled with the smtp_sasl_auth_soft_bounce configurationparameter.
By default, the Postfix SMTP client moves on the next mailexchanger. Specify "smtp_skip_5xx_greeting = no" if Postfix shouldbounce the mail immediately. Caution: the latter behavior appearsto contradict RFC 2821.
Do not configure client certificates unless you must presentclient TLS certificates to one or more servers. Client certificates arenot usually needed, and can cause problems in configurations that workwell without them. The recommended setting is to let the defaults stand:
The first setting disables anonymous ciphers. The next settingdisables ciphers that use the MD5 digest algorithm or the (single) DESencryption algorithm. The next setting disables ciphers that use MD5 andDES together. The next setting disables the two ciphers "AES256-SHA"and "DES-CBC3-MD5". The last setting disables ciphers that use "EDH"key exchange with RSA authentication. 2ff7e9595c
留言