{"id":38313,"date":"2019-10-31T22:22:55","date_gmt":"2019-10-31T19:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-pravilno-nastroit-sni-v-zimbra-ose\/"},"modified":"2019-10-31T22:22:55","modified_gmt":"2019-10-31T19:22:55","slug":"kak-pravilno-nastroit-sni-v-zimbra-ose","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","title":{"rendered":"Jak spr\u00e1vn\u011b nastavit SNI v Zimbra OSE?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Na po\u010d\u00e1tku 21. stolet\u00ed do\u0161lo k vy\u010derp\u00e1n\u00ed takov\u00e9ho zdroje, jako jsou adresy IPv4. Ji\u017e v roce 2011 IANA p\u0159id\u011blila region\u00e1ln\u00edm internetov\u00fdm registr\u00e1tor\u016fm posledn\u00edch p\u011bt zb\u00fdvaj\u00edc\u00edch blok\u016f \/8 ze sv\u00e9ho adresn\u00edho prostoru, a ji\u017e v roce 2017 se tyto adresy vy\u010derpaly i u nich. Odpov\u011bd\u00ed na katastrof\u00e1ln\u00ed nedostatek IPv4 adres nebylo jen zaveden\u00ed protokolu IPv6, ale tak\u00e9 technologie SNI, kter\u00e1 umo\u017enila umis\u0165ovat nespo\u010det webov\u00fdch str\u00e1nek na jednu IPv4 adresu. Podstata SNI spo\u010d\u00edv\u00e1 v tom, \u017ee toto roz\u0161\u00ed\u0159en\u00ed umo\u017e\u0148uje klient\u016fm v pr\u016fb\u011bhu handshake sd\u011blit serveru n\u00e1zev webu, se kter\u00fdm se cht\u011bj\u00ed spojit. To serveru umo\u017e\u0148uje uchov\u00e1vat \u0159adu certifik\u00e1t\u016f a t\u00edm zajistit provoz mnoha dom\u00e9n na jedn\u00e9 IP adrese. Technologie SNI se stala zvl\u00e1\u0161\u0165 \u017e\u00e1danou mezi poskytovateli SaaS pro podniky, kte\u0159\u00ed nyn\u00ed maj\u00ed mo\u017enost hostit prakticky neomezen\u00fd po\u010det dom\u00e9n bez ohledu na pot\u0159ebn\u00fd po\u010det IPv4 adres. Poj\u010fme se pod\u00edvat, jak implementovat podporu SNI v Zimbra Collaboration Suite Open-Source Edition.<\/p>\n

\"Jak<\/a><\/noindex><\/p>\n

SNI funguje ve v\u0161ech aktu\u00e1ln\u00edch a podporovan\u00fdch verz\u00edch Zimbra OSE. V p\u0159\u00edpad\u011b, \u017ee va\u0161e Zimbra Open-Source b\u011b\u017e\u00ed na v\u00edce\u00farov\u0148ov\u00e9 infrastruktu\u0159e, mus\u00edte prov\u00e9st v\u0161echny n\u00ed\u017ee uveden\u00e9 kroky na uzlu s nainstalovan\u00fdm Proxy serverem Zimbra. Krom\u011b toho budete pot\u0159ebovat odpov\u00eddaj\u00edc\u00ed dvojice certifik\u00e1t + kl\u00ed\u010d a d\u016fv\u011bryhodn\u00e9 certifika\u010dn\u00ed \u0159et\u011bzce od va\u0161\u00ed certifika\u010dn\u00ed autority pro ka\u017edou z dom\u00e9n, kter\u00e9 chcete um\u00edstit na svou IPv4 adresu. Upozor\u0148ujeme, \u017ee v\u011bt\u0161ina chyb p\u0159i nastavov\u00e1n\u00ed SNI v Zimbra OSE poch\u00e1z\u00ed z nespr\u00e1vn\u00fdch soubor\u016f certifik\u00e1t\u016f. Proto doporu\u010dujeme pe\u010dliv\u011b v\u0161e zkontrolovat p\u0159ed jejich skute\u010dnou instalac\u00ed.<\/p>\n

Nejprve je t\u0159eba zadat p\u0159\u00edkaz, aby SNI spr\u00e1vn\u011b fungovalo. zmprov mcf zimbraReverseProxySNIEnabled TRUE<\/b> na uzlu s Proxy serverem Zimbra, a pot\u00e9 restartovat slu\u017ebu Proxy pomoc\u00ed p\u0159\u00edkazu.\u00a0zmproxyctl restart<\/b>.<\/p>\n

Za\u010dneme vytvo\u0159en\u00edm dom\u00e9nov\u00e9ho jm\u00e9na. Jako p\u0159\u00edklad vezmeme dom\u00e9nu company.ru<\/b> a po vytvo\u0159en\u00ed dom\u00e9ny ur\u010d\u00edme n\u00e1zev virtu\u00e1ln\u00edho hostitele Zimbra a virtu\u00e1ln\u00ed IP adresu. Upozor\u0148ujeme, \u017ee n\u00e1zev virtu\u00e1ln\u00edho hostitele Zimbra by m\u011bl odpov\u00eddat n\u00e1zvu, kter\u00fd by m\u011bl u\u017eivatel zadat do adresn\u00edho \u0159\u00e1dku pro p\u0159\u00edstup k dom\u00e9n\u011b, a m\u011bl by se shodovat s n\u00e1zvem uveden\u00fdm v certifik\u00e1tu. Jako p\u0159\u00edklad vezmeme n\u00e1zev virtu\u00e1ln\u00edho hostitele Zimbra mail.company.ru<\/b>, a jako virtu\u00e1ln\u00ed IPv4 adresu pou\u017eijeme adresu 1.2.3.4<\/b>.<\/p>\n

Pot\u00e9 sta\u010d\u00ed zadat p\u0159\u00edkaz zmprov md company.ru zimbraVirtualHostName mail.company.ru zimbraVirtualIPAddress 1.2.3.4<\/b>, abychom spojili virtu\u00e1ln\u00ed hostitele Zimbra s virtu\u00e1ln\u00edm IP adresu<\/a>. Upozor\u0148ujeme, \u017ee pokud je server za NAT nebo firewallem, je nutn\u00e9 zajistit, aby v\u0161echny po\u017eadavky na dom\u00e9nu sm\u011b\u0159ovaly pr\u00e1v\u011b na p\u0159id\u011blenou extern\u00ed IP adresu, a nikoli na jej\u00ed adresu v m\u00edstn\u00ed s\u00edti.<\/p>\n

Jakmile bude v\u0161echno hotovo, zb\u00fdv\u00e1 pouze zkontrolovat a p\u0159ipravit certifik\u00e1ty dom\u00e9ny k instalaci a pot\u00e9 je nainstalovat.<\/p>\n

Pokud prob\u011bhlo vyd\u00e1n\u00ed certifik\u00e1tu na dom\u00e9nu spr\u00e1vn\u011b, m\u011bli byste m\u00edt t\u0159i soubory s certifik\u00e1ty: dva z nich p\u0159edstavuj\u00ed \u0159et\u011bzce certifik\u00e1t\u016f od va\u0161eho certifika\u010dn\u00edho \u00fa\u0159adu a jeden je p\u0159\u00edmo certifik\u00e1t k dom\u00e9n\u011b. D\u00e1le byste m\u011bli m\u00edt soubor s kl\u00ed\u010dem, kter\u00fd jste pou\u017eili k z\u00edsk\u00e1n\u00ed certifik\u00e1tu. Vytvo\u0159te si samostatnou slo\u017eku \/tmp\/company.ru<\/b> a um\u00edst\u011bte tam v\u0161echny dostupn\u00e9 soubory s kl\u00ed\u010di a certifik\u00e1ty. Nakonec by to m\u011blo vypadat takto:<\/p>\n

ls \/tmp\/company.ru\ncompany.ru.key\n company.ru.crt\n company.ru.root.crt\n company.ru.intermediate.crt<\/code><\/pre>\n
\nPot\u00e9 spoj\u00edme \u0159et\u011bzce certifik\u00e1t\u016f do jednoho souboru pomoc\u00ed p\u0159\u00edkazu cat company.ru.root.crt company.ru.intermediate.crt >> company.ru_ca.crt<\/b> a ujist\u00edme se, \u017ee je s certifik\u00e1ty v\u0161echno v po\u0159\u00e1dku pomoc\u00ed p\u0159\u00edkazu \/opt\/zimbra\/bin\/zmcertmgr verifycrt comm \/tmp\/company.ru\/company.ru.key \/tmp\/company.ru\/company.ru.crt \/tmp\/company.ru\/company.ru_ca.crt<\/b>. Jakmile bude kontrola certifik\u00e1t\u016f a kl\u00ed\u010de \u00fasp\u011b\u0161n\u00e1, m\u016f\u017eeme p\u0159istoupit k jejich instalaci.<\/p>\n
Abychom zah\u00e1jili instalaci, nejprve spoj\u00edme certifik\u00e1t k dom\u00e9n\u011b a d\u016fv\u011bryhodn\u00e9 \u0159et\u011bzce z certifika\u010dn\u00edch \u00fa\u0159ad\u016f do jednoho souboru. D\u011bl\u00e1 se to tak\u00e9 pomoc\u00ed jednoho p\u0159\u00edkazu ve tvaru\u00a0cat company.ru.crt company.ru_ca.crt >> company.ru.bundle<\/b>. Pot\u00e9 je nutn\u00e9 prov\u00e9st p\u0159\u00edkaz k zaps\u00e1n\u00ed v\u0161ech certifik\u00e1t\u016f a kl\u00ed\u010de do LDAP: \/opt\/zimbra\/libexec\/zmdomaincertmgr savecrt company.ru company.ru.bundle company.ru.key<\/b>, a pot\u00e9 nainstalovat certifik\u00e1ty pomoc\u00ed p\u0159\u00edkazu \/opt\/zimbra\/libexec\/zmdomaincertmgr deploycrts<\/b>Po nainstalov\u00e1n\u00ed budou certifik\u00e1ty a kl\u00ed\u010d od dom\u00e9ny company.ru ulo\u017eeny ve slo\u017ece \/opt\/zimbra\/conf\/domaincerts\/company.ru<\/b>.\u00a0<\/p>\n
Opakov\u00e1n\u00edm t\u011bchto krok\u016f s pou\u017eit\u00edm r\u016fzn\u00fdch dom\u00e9n, ale stejn\u00e9 IP adresy, lze dos\u00e1hnout hostov\u00e1n\u00ed n\u011bkolika stovek dom\u00e9n na jedn\u00e9 IPv4 adrese. P\u0159i\u010dem\u017e je mo\u017en\u00e9 bez probl\u00e9m\u016f pou\u017e\u00edvat certifik\u00e1ty z r\u016fzn\u00fdch certifika\u010dn\u00edch autorit. Ov\u011b\u0159en\u00ed spr\u00e1vnosti v\u0161ech proveden\u00fdch krok\u016f lze prov\u00e9st v jak\u00e9mkoli prohl\u00ed\u017ee\u010di, kde by pro ka\u017ed\u00e9 virtu\u00e1ln\u00ed jm\u00e9no hostitele m\u011blo b\u00fdt zobrazeno sv\u00e9 SSL certifik\u00e1t<\/a>.\u00a0<\/p>\n
Na v\u0161echny ot\u00e1zky t\u00fdkaj\u00edc\u00ed se Zextras Suite se m\u016f\u017eete obr\u00e1tit na z\u00e1stupce spole\u010dnosti \u201eZextras\u201c Ekaterinu Triandafilidi na e-mailu katerina@zextras.com
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4. \u0415\u0449\u0435 \u0432 2011 \u0433\u043e\u0434\u0443 IANA \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0430 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u044f\u0442\u044c \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u043b\u043e\u043a\u043e\u0432 \/8 \u0438\u0437 \u0441\u0432\u043e\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430, \u0430 \u0443\u0436\u0435 \u0432 2017 \u0433\u043e\u0434\u0443 \u0430\u0434\u0440\u0435\u0441\u0430 \u0437\u0430\u043a\u043e\u043d\u0447\u0438\u043b\u0438\u0441\u044c \u0438 \u0443 \u043d\u0438\u0445. \u041e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043d\u0435\u0445\u0432\u0430\u0442\u043a\u0443 IPv4-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441\u0442\u0430\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv6, \u043d\u043e \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 SNI, \u043a\u043e\u0442\u043e\u0440\u0430\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28761,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38313","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jak spr\u00e1vn\u011b nastavit SNI v Zimbra OSE? | ProHoster","description":"Na za\u010d\u00e1tku 21. stolet\u00ed byl na pokraji vy\u010derp\u00e1n\u00ed takov\u00fd zdroj jako adresy IPv4.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c SNI \u0432 Zimbra OSE? | ProHoster","og:description":"\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:55+00:00","article:modified_time":"2019-10-31T19:22:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38313","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:37:35","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:11:24","updated":"2026-02-08 20:37:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=38313"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38313\/revisions"}],"predecessor-version":[{"id":157779,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38313\/revisions\/157779"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/28761"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=38313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=38313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=38313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}