# Ubuntu
sudo apt update
sudo apt install certbot
# CentOS 8
sudo yum -y install epel-release
sudo yum -y install certbot
# CentOS 7
sudo yum -y install epel-release
sudo yum -y install certbot
$ certbot –version
certbot 0.40.0
Step 2: Stop Zimbra Proxy Service
$ sudo su – zimbra -c “zmproxyctl stop”
Stopping proxy…done.
$ sudo su – zimbra -c “zmmailboxdctl stop”
Stopping mailboxd…done.
Step 3: Obtain Let’s Encrypt SSL Certificate
$ ls -lh /etc/letsencrypt/live/$ZIMBRA_FQDN
total 4.0K
lrwxrwxrwx. 1 root root 50 Jul 5 23:42 cert.pem -> ../../archive/mail.computingforgeeks.com/cert1.pem
lrwxrwxrwx. 1 root root 51 Jul 5 23:42 chain.pem -> ../../archive/mail.computingforgeeks.com/chain1.pem
lrwxrwxrwx. 1 root root 55 Jul 5 23:42 fullchain.pem -> ../../archive/mail.computingforgeeks.com/fullchain1.pem
lrwxrwxrwx. 1 root root 53 Jul 5 23:42 privkey.pem -> ../../archive/mail.computingforgeeks.com/privkey1.pem
-rw-r–r–. 1 root root 692 Jul 5 23:42 README
Step 4: Secure Zimbra Mail Server with Let’s Encrypt SSL Certificate
CERTPATH=/etc/letsencrypt/live/$ZIMBRA_FQDN
sudo cp $CERTPATH/* /opt/zimbra/ssl/letsencrypt/
$ ls /opt/zimbra/ssl/letsencrypt/
cert.pem chain.pem fullchain.pem privkey.pem README
https://letsencrypt.org/certs/isrgrootx1.pem.txt
—–BEGIN CERTIFICATE—–
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
—–END CERTIFICATE—–
Place Let’s Encrypt chain in /opt/zimbra/ssl/letsencrypt/zimbra_chain.pem file.
cat $CERTPATH/chain.pem | sudo tee /opt/zimbra/ssl/letsencrypt/zimbra_chain.pem
cat /opt/zimbra/ssl/letsencrypt/zimbra_chain.pem
sudo tee -a /opt/zimbra/ssl/letsencrypt/zimbra_chain.pem<
** Creating /opt/zimbra/conf/ca/commercial_ca_1.crt
** Creating CA hash symlink ‘4f06f81d.0’ -> ‘commercial_ca_1.crt’
** Creating /opt/zimbra/conf/ca/commercial_ca_2.crt
** Creating CA hash symlink ‘2e5ac55d.0’ -> ‘commercial_ca_2.crt’
$ sudo su – zimbra -c “zmcontrol restart”
Host mail.computingforgeeks.com
Stopping zmconfigd…Done.
Stopping zimlet webapp…Done.
Stopping zimbraAdmin webapp…Done.
Stopping zimbra webapp…Done.
Stopping service webapp…Done.
Stopping stats…Done.
Stopping mta…Done.
Stopping spell…Done.
Stopping snmp…Done.
Stopping cbpolicyd…Done.
Stopping archiving…Done.
Stopping opendkim…Done.
Stopping amavis…Done.
Stopping antivirus…Done.
Stopping antispam…Done.
Stopping proxy…Done.
Stopping memcached…Done.
Stopping mailbox…Done.
Stopping logger…Done.
Stopping dnscache…Done.
Stopping ldap…Done.
Host mail.computingforgeeks.com
Starting ldap…Done.
Starting zmconfigd…Done.
Starting dnscache…Done.
Starting logger…Done.
Starting mailbox…Done.
Starting memcached…Done.
Starting proxy…Done.
Starting amavis…Done.
Starting antispam…Done.
Starting antivirus…Done.
Starting opendkim…Done.
Starting snmp…Done.
Starting spell…Done.
Starting mta…Done.
Starting stats…Done.
Starting service webapp…Done.
Starting zimbra webapp…Done.
Starting zimbraAdmin webapp…Done.
Starting zimlet webapp…Done.
Step 5: Test Let’s Encrypt SSL Certificate on Zimbra Mail Server