{"id":38313,"date":"2019-10-31T22:22:55","date_gmt":"2019-10-31T19:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-pravilno-nastroit-sni-v-zimbra-ose\/"},"modified":"2019-10-31T22:22:55","modified_gmt":"2019-10-31T19:22:55","slug":"kak-pravilno-nastroit-sni-v-zimbra-ose","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","title":{"rendered":"Hvordan konfigurerer man SNI korrekt i Zimbra OSE?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I begyndelsen af det 21. \u00e5rhundrede var ressourcen, som IPv4-adresser, n\u00e6sten udt\u00f8mt. Allerede i 2011 tildelte IANA de sidste fem resterende \/8 blokke fra sit adresseomr\u00e5de til regionale Internetregistratorer, og i 2017 var adresserne ogs\u00e5 udt\u00f8mt for dem. Svaret p\u00e5 den katastrofale mangel p\u00e5 IPv4-adresser blev ikke kun introduktionen af IPv6-protokollen, men ogs\u00e5 SNI-teknologi, som muligg\u00f8r hosting af et stort antal websites p\u00e5 \u00e9n IPv4-adresse. Essensen af SNI er, at det er en udvidelse, der g\u00f8r det muligt for klienterne at informere serveren om navnet p\u00e5 det website, de \u00f8nsker at forbinde til, under handshake-processen. Dette muligg\u00f8r, at serveren kan opbevare mange certifikater, hvilket g\u00f8r det muligt at underst\u00f8tte mange dom\u00e6ner p\u00e5 \u00e9n IP-adresse. SNI-teknologien er is\u00e6r efterspurgt blandt SaaS-udbydere for virksomheder, som nu kan hoste praktisk talt et ubegribelig antal dom\u00e6ner uden at v\u00e6re afh\u00e6ngige af det n\u00f8dvendige antal IPv4-adresser. Lad os finde ud af, hvordan vi kan implementere SNI-support i Zimbra Collaboration Suite Open-Source Edition.<\/p>\n

\"Hvordan<\/a><\/noindex><\/p>\n

SNI fungerer p\u00e5 alle aktuelle og underst\u00f8ttede versioner af Zimbra OSE. Hvis du har Zimbra Open-Source, som k\u00f8rer p\u00e5 en multiserverinfrastruktur, skal du udf\u00f8re alle de f\u00f8lgende trin p\u00e5 noden med den installerede Zimbra Proxy-server. Derudover har du brug for matchende par certifikat + n\u00f8gle samt betroede certifikatk\u00e6der fra dit certifikatcenter for hvert af de dom\u00e6ner, du \u00f8nsker at hoste p\u00e5 din IPv4-adresse. Vi vil gerne understrege, at \u00e5rsagen til langt de fleste fejl ved ops\u00e6tning af SNI i Zimbra OSE netop ligger i ukorrekte certifikatfiler. Derfor anbefaler vi, at du kontrollerer alt n\u00f8je, inden de bliver installeret.<\/p>\n

F\u00f8rst og fremmest, for at SNI kan fungere korrekt, skal du indtaste kommandoen zmprov mcf zimbraReverseProxySNIEnabled TRUE<\/b> p\u00e5 noden med Zimbra Proxy-serveren og derefter genstarte Proxy-tjenesten ved hj\u00e6lp af kommandoen\u00a0zmproxyctl restart<\/b>.<\/p>\n

Lad os begynde med at oprette et dom\u00e6nenavn. For eksempel vil vi tage dom\u00e6net company.ru<\/b> Og efter at dom\u00e6net er oprettet, lad os bestemme navnet p\u00e5 Zimbra-virtuel v\u00e6rt og den virtuelle IP-adresse. Vi understreger, at navnet p\u00e5 Zimbra-virtuel v\u00e6rt skal svare til navnet, som brugeren skal indtaste i browserens adressefelt for at f\u00e5 adgang til dom\u00e6net, samt matche navnet angivet i certifikatet. Som eksempel vil vi tage navnet p\u00e5 den virtuelle v\u00e6rt Zimbra. mail.company.ru<\/b>, og som den virtuelle IPv4-adresse bruger vi adressen 1.2.3.4<\/b>.<\/p>\n

Efter dette er det tilstr\u00e6kkeligt at indtaste kommandoen zmprov md company.ru zimbraVirtualHostName mail.company.ru zimbraVirtualIPAddress 1.2.3.4<\/b>, for at knytte den virtuelle Zimbra-v\u00e6rt til den virtuelle IP-adressen<\/a>. Vi bem\u00e6rker, at hvis serveren befinder sig bag NAT eller firewall, er det vigtigt at sikre, at alle foresp\u00f8rgsler til dom\u00e6net sendes til den eksterne IP-adresse knyttet til det, og ikke til dens adresse i det lokale netv\u00e6rk.<\/p>\n

N\u00e5r alt er gjort, er det kun tilbage at kontrollere og forberede dom\u00e6nets certifikater til installation, og derefter installere dem.<\/p>\n

Hvis udstedelsen af certifikatet til dom\u00e6net er g\u00e5et korrekt, b\u00f8r du have tre filer med certifikater: to af dem repr\u00e6senterer k\u00e6der af certifikater fra dit certifikationscenter, og \u00e9n er det direkte certifikat til dom\u00e6net. Derudover skal du have en fil med den n\u00f8gle, som du brugte til at f\u00e5 certifikatet. Opret en separat mappe \/tmp\/company.ru<\/b> og plac\u00e9r alle eksisterende filer med n\u00f8gler og certifikater der. Resultatet b\u00f8r blive noget i denne stil:<\/p>\n

ls \/tmp\/company.ru\ncompany.ru.key\n company.ru.crt\n company.ru.root.crt\n company.ru.intermediate.crt<\/code><\/pre>\n
\nDerefter sammenfletter vi k\u00e6derne af certifikater i \u00e9n fil ved hj\u00e6lp af kommandoen cat company.ru.root.crt company.ru.intermediate.crt >> company.ru_ca.crt<\/b> og sikrer, at alt er i orden med certifikaterne ved hj\u00e6lp af kommandoen \/opt\/zimbra\/bin\/zmcertmgr verifycrt comm \/tmp\/company.ru\/company.ru.key \/tmp\/company.ru\/company.ru.crt \/tmp\/company.ru\/company.ru_ca.crt<\/b>. N\u00e5r kontrollen af certifikaterne og n\u00f8gle er vellykket, kan installationen begynde.<\/p>\n
For at starte installationen skal vi f\u00f8rst sammenflette certifikatet til dom\u00e6net og de betroede k\u00e6der fra certifikationscentre i \u00e9n fil. Dette g\u00f8res ogs\u00e5 ved hj\u00e6lp af en kommando som\u00a0cat company.ru.crt company.ru_ca.crt >> company.ru.bundle<\/b>. Efter dette er det n\u00f8dvendigt at udf\u00f8re kommandoen for at skrive alle certifikater og n\u00f8gler til LDAP: \/opt\/zimbra\/libexec\/zmdomaincertmgr savecrt company.ru company.ru.bundle company.ru.key<\/b>, og derefter installere certifikaterne ved hj\u00e6lp af kommandoen \/opt\/zimbra\/libexec\/zmdomaincertmgr deploycrts<\/b>. Efter installationen vil certifikaterne og n\u00f8glen til dom\u00e6net company.ru blive opbevaret i en mappe \/opt\/zimbra\/conf\/domaincerts\/company.ru<\/b>.\u00a0<\/p>\n
Ved at gentage disse handlinger med forskellige dom\u00e6nenavne, men den samme IP-adresse, kan man hoste flere hundrede dom\u00e6ner p\u00e5 \u00e9n IPv4-adresse. Derudover kan man uden problemer bruge certifikater fra forskellige udstedercentre. Man kan kontrollere rigtigheden af alle udf\u00f8rte handlinger i enhver browser, hvor hver virtuel v\u00e6rtsnavn skal vise sin egen SSL-certifikat<\/a>.\u00a0<\/p>\n
Hvis du har sp\u00f8rgsm\u00e5l vedr\u00f8rende Zextras Suite, kan du kontakte virksomhedens repr\u00e6sentant \"Zextras\", Ekaterina Triandafiliidi, p\u00e5 e-mail katerina@zextras.com
\n
Kilde: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4. \u0415\u0449\u0435 \u0432 2011 \u0433\u043e\u0434\u0443 IANA \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0430 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u044f\u0442\u044c \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u043b\u043e\u043a\u043e\u0432 \/8 \u0438\u0437 \u0441\u0432\u043e\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430, \u0430 \u0443\u0436\u0435 \u0432 2017 \u0433\u043e\u0434\u0443 \u0430\u0434\u0440\u0435\u0441\u0430 \u0437\u0430\u043a\u043e\u043d\u0447\u0438\u043b\u0438\u0441\u044c \u0438 \u0443 \u043d\u0438\u0445. \u041e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043d\u0435\u0445\u0432\u0430\u0442\u043a\u0443 IPv4-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441\u0442\u0430\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv6, \u043d\u043e \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 SNI, \u043a\u043e\u0442\u043e\u0440\u0430\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28761,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38313","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hvordan ops\u00e6tter man SNI korrekt i Zimbra OSE? | ProHoster","description":"I begyndelsen af det 21. \u00e5rhundrede var ressourcen som IPv4-adresser ved at v\u00e6re udt\u00f8mt.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c SNI \u0432 Zimbra OSE? | ProHoster","og:description":"\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:55+00:00","article:modified_time":"2019-10-31T19:22:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38313","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:37:35","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:11:24","updated":"2026-02-08 20:37:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/38313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=38313"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/38313\/revisions"}],"predecessor-version":[{"id":157779,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/38313\/revisions\/157779"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/28761"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=38313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=38313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=38313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}