{"id":38313,"date":"2019-10-31T22:22:55","date_gmt":"2019-10-31T19:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-pravilno-nastroit-sni-v-zimbra-ose\/"},"modified":"2019-10-31T22:22:55","modified_gmt":"2019-10-31T19:22:55","slug":"kak-pravilno-nastroit-sni-v-zimbra-ose","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","title":{"rendered":"Kuidas seadistada SNI Zimbra OSE-s \u00f5igesti?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

21. sajandi alguses oli IPv4-aadresside ressurss peaaegu otsas. Juba 2011. aastal eraldas IANA viimased viis j\u00e4\u00e4nud IPv4 plokki \/8 oma aadressiruumist piirkondlikele interneti registreerijatele, ning 2017. aastaks olid need aadressid ka neile otsa saanud. Vastuseks katastroofilisele IPv4-aadresside puudusele ei tulnud mitte ainult protokoll IPv6, vaid ka SNI tehnoloogia, mis v\u00f5imaldas \u00fche IPv4-aadressi k\u00fclge siduda tohutul hulgal veebisaite. SNI p\u00f5him\u00f5te seisneb selles, et see laiendus v\u00f5imaldab klientidel \u00fchenduse loomise k\u00e4igus serverile edastada selle veebisaidi nime, millega nad soovivad \u00fchendada. See v\u00f5imaldab serveril salvestada palju sertifikaate, v\u00f5imaldades seega mitmete domeenide t\u00f6\u00f6tamist \u00fchel IP-aadressil. SNI tehnoloogia on muutunud eriti n\u00f5utuks ettev\u00f5tete SaaS-teenuse pakkujate seas, kes said v\u00f5imaluse majutada praktikaliselt piiramatult domeene, ilma et peaksid muretsema vajalike IPv4-aadresside arvu p\u00e4rast. Uurime, kuidas SNI-i tuge Zimbra Collaboration Suite Open-Source Edition'is rakendada.<\/p>\n

\"Kuidas<\/a><\/noindex><\/p>\n

SNI toimib k\u00f5ikides aktuaalsetes ja toetatavates Zimbra OSE versioonides. Kui teil on Zimbra Open-Source, mis t\u00f6\u00f6tab mitme serveri infrastruktuuris, peate k\u00f5ik j\u00e4rgnevad toimingud sooritama Zimbra Proxy serveriga varustatud node'il. Lisaks on teil vaja sobivaid sertifikaadi ja v\u00f5tme paare ning usaldusv\u00e4\u00e4rseid sertifikaadi ahelate jadasid teie sertifitseerimiskeskuselt iga domeeni jaoks, mida soovite oma IPv4-aadressile majutada. T\u00f5stame esile, et enamik SNI seadistamise vigu Zimbra OSE-s tulenevad just vigastest sertifikaadi failidest. Seep\u00e4rast soovitame enne nende installimist hoolikalt k\u00f5ik \u00fcle vaadata.<\/p>\n

Esiteks, et SNI korralikult t\u00f6\u00f6taks, tuleb sisestada k\u00e4sk zmprov mcf zimbraReverseProxySNIEnabled TRUE<\/b> Zimbra Proxy-serveriga node'il ja seej\u00e4rel k\u00e4ivitada Proxy teenus uuesti k\u00e4su abil\u00a0zmproxyctl restart<\/b>.<\/p>\n

Alustame domeeninime loomisega. N\u00e4iteks v\u00f5tame domeeni company.ru<\/b> Ja, ja p\u00e4rast domeeni loomist m\u00e4\u00e4rame Zimbra virtuaalse hosti nime ja virtuaalse IP-aadressi. P\u00f6\u00f6rame t\u00e4helepanu sellele, et Zimbra virtuaalse hosti nimi peaks vastama nimele, mille kasutaja peab brauseri aadressiribale sisestama, et p\u00e4\u00e4seda domeenile ja vastama ka sertifikaadis m\u00e4rgitud nimel. N\u00e4iteks v\u00f5tame Zimbra virtuaalse hosti nimeks mail.company.ru<\/b>, ja virtuaalse IPv4-aadressina kasutame aadressi 1.2.3.4<\/b>.<\/p>\n

P\u00e4rast seda piisab k\u00e4sku sisestamisest zmprov md company.ru zimbraVirtualHostName mail.company.ru zimbraVirtualIPAddress 1.2.3.4<\/b>, et siduda Zimbra virtuaalne host virtuaalsega IP-aadressiga<\/a>. P\u00f6\u00f6rame t\u00e4helepanu sellele, et kui server asub NAT-i v\u00f5i tulem\u00fc\u00fcri taga, tuleb hoolitseda selle eest, et k\u00f5ik domeenile tehtud p\u00e4ringud suunataks just sellele seotud v\u00e4lisele IP-aadressile, mitte selle kohaliku v\u00f5rgu aadressile.<\/p>\n

P\u00e4rast k\u00f5igi toimingute l\u00f5petamist j\u00e4\u00e4b vaid kontrollida ja ette valmistada domeeni sertifikaadid installatsiooniks ning seej\u00e4rel need paigaldada.<\/p>\n

Kui domeeni sertifikaadi v\u00e4ljastamine on l\u00e4inud korrektselt, peaks teil olema kolm sertifikaadifaili: kaks neist esindavad teie sertifitseerimiskeskuse sertifikaadi ahelat ja \u00fcks on domeeni otsene sertifikaat. Lisaks peaks teil olema fail v\u00f5tmega, mida kasutasite sertifikaadi saamiseks. Looge eraldi kaust \/tmp\/company.ru<\/b> ja asetage sinna k\u00f5ik olemasolevad v\u00f5tme- ja sertifikaadifailid. Tulemuseks peaks olema midagi sellist:<\/p>\n

ls \/tmp\/company.ru\ncompany.ru.key\n company.ru.crt\n company.ru.root.crt\n company.ru.intermediate.crt<\/code><\/pre>\n
\nP\u00e4rast seda \u00fchendame sertifikaadi ahelad \u00fchte faili j\u00e4rgmise k\u00e4su abil cat company.ru.root.crt company.ru.intermediate.crt >> company.ru_ca.crt<\/b> ja veendume, et sertifikaatidega on k\u00f5ik korras j\u00e4rgmise k\u00e4su abil \/opt\/zimbra\/bin\/zmcertmgr verifycrt comm \/tmp\/company.ru\/company.ru.key \/tmp\/company.ru\/company.ru.crt \/tmp\/company.ru\/company.ru_ca.crt<\/b>. P\u00e4rast sertifikaatide ja v\u00f5tme edukat kontrollimist v\u00f5ime alustada nende installeerimist.<\/p>\n
Selleks, et alustada installatsiooni, \u00fchendame esmalt domeeni sertifikaadi ja usaldusv\u00e4\u00e4rsed ahelad sertifitseerimiskeskustelt \u00fchte faili. Seda tehakse samuti \u00fche k\u00e4su abil, n\u00e4iteks\u00a0cat company.ru.crt company.ru_ca.crt >> company.ru.bundle<\/b>. P\u00e4rast seda tuleb k\u00e4ivitada k\u00e4sk, et salvestada k\u00f5ik sertifikaadid ja v\u00f5tmed LDAP-i: \/opt\/zimbra\/libexec\/zmdomaincertmgr savecrt company.ru company.ru.bundle company.ru.key<\/b>, ja seej\u00e4rel paigaldada sertifikaadid j\u00e4rgmise k\u00e4su abil \/opt\/zimbra\/libexec\/zmdomaincertmgr deploycrts<\/b>. P\u00e4rast sertifikaadi installimist ja domeeni company.ru v\u00f5tme hoidmine toimub kaustas \/opt\/zimbra\/conf\/domaincerts\/company.ru<\/b>.\u00a0<\/p>\n
Korrates neid toiminguid erinevate domeeninimede kasutamisega, kuid sama IP-aadressiga, on v\u00f5imalik paigutada sadade domeenide jaoks \u00fche IPv4-aadressi alla. Sellega saab probleemideta kasutada sertifikaate erinevatelt v\u00e4ljastajatelt. K\u00f5ikide tehtud toimingute \u00f5igust v\u00f5ib kontrollida igas brauseris, kus iga virtuaalse hostinime jaoks peaks olema oma SSL-sertifikaat<\/a>.\u00a0<\/p>\n
K\u00fcsimuste korral, mis on seotud Zextras Suite'iga, v\u00f5ite p\u00f6\u00f6rduda ettev\u00f5tte \u00abZextras\u00bb esindaja Ekaterina Triandafiliidi poole e-posti aadressil katerina@zextras.com
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4. \u0415\u0449\u0435 \u0432 2011 \u0433\u043e\u0434\u0443 IANA \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0430 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u044f\u0442\u044c \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u043b\u043e\u043a\u043e\u0432 \/8 \u0438\u0437 \u0441\u0432\u043e\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430, \u0430 \u0443\u0436\u0435 \u0432 2017 \u0433\u043e\u0434\u0443 \u0430\u0434\u0440\u0435\u0441\u0430 \u0437\u0430\u043a\u043e\u043d\u0447\u0438\u043b\u0438\u0441\u044c \u0438 \u0443 \u043d\u0438\u0445. \u041e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043d\u0435\u0445\u0432\u0430\u0442\u043a\u0443 IPv4-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441\u0442\u0430\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv6, \u043d\u043e \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 SNI, \u043a\u043e\u0442\u043e\u0440\u0430\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28761,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38313","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kuidas \u00f5igesti seadistada SNI Zimbra OSE-s? | ProHoster","description":"21. sajandi alguses oli IPv4 aadresside ressurss viimase piiri peal.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c SNI \u0432 Zimbra OSE? | ProHoster","og:description":"\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:55+00:00","article:modified_time":"2019-10-31T19:22:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38313","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:37:35","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:11:24","updated":"2026-02-08 20:37:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=38313"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38313\/revisions"}],"predecessor-version":[{"id":157779,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38313\/revisions\/157779"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/28761"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=38313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=38313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=38313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}