{"id":38313,"date":"2019-10-31T22:22:55","date_gmt":"2019-10-31T19:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-pravilno-nastroit-sni-v-zimbra-ose\/"},"modified":"2019-10-31T22:22:55","modified_gmt":"2019-10-31T19:22:55","slug":"kak-pravilno-nastroit-sni-v-zimbra-ose","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","title":{"rendered":"Ako spr\u00e1vne nastavi\u0165 SNI v Zimbra OSE?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Na za\u010diatku 21. storo\u010dia sa bl\u00ed\u017eilo vy\u010derpanie takejto zdroja, ako s\u00fa adresy IPv4. U\u017e v roku 2011 IANA pridelila region\u00e1lnym internetov\u00fdm registr\u00e1torom posledn\u00fdch p\u00e4\u0165 zost\u00e1vaj\u00facich blokov \/8 zo svojho adresn\u00e9ho priestoru, a u\u017e v roku 2017 sa adresy minuli aj im. Odpove\u010fou na katastrofick\u00fd nedostatok adries IPv4 sa stalo nielen zavedenie protokolu IPv6, ale aj technol\u00f3gie SNI, ktor\u00e1 umo\u017enila umiestni\u0165 obrovsk\u00e9 mno\u017estvo webov\u00fdch str\u00e1nok na jednu IPv4 adresu. Z\u00e1klad SNI spo\u010d\u00edva v tom, \u017ee toto roz\u0161\u00edrenie umo\u017e\u0148uje klientom pri handshake s serverom ozn\u00e1mi\u0165 n\u00e1zov webu, s ktor\u00fdm sa chc\u00fa pripoji\u0165. To umo\u017e\u0148uje serveru uchov\u00e1va\u0165 mno\u017estvo certifik\u00e1tov, a teda zabezpe\u010dova\u0165 prev\u00e1dzku mno\u017estva dom\u00e9n na jednej IP adrese. Technol\u00f3gia SNI sa stala mimoriadne \u017eiadanou medzi SaaS poskytovate\u013emi pre firmy, ktor\u00ed z\u00edskali mo\u017enos\u0165 hosti\u0165 takmer neobmedzen\u00e9 mno\u017estvo dom\u00e9n bez oh\u013eadu na potrebn\u00fd po\u010det adries IPv4. Po\u010fme sa teda pozrie\u0165, ako m\u00f4\u017eeme implementova\u0165 podporu SNI v Zimbra Collaboration Suite Open-Source Edition.<\/p>\n

\"Ako<\/a><\/noindex><\/p>\n

SNI funguje vo v\u0161etk\u00fdch aktu\u00e1lnych a podporovan\u00fdch verzi\u00e1ch Zimbra OSE. V pr\u00edpade, \u017ee m\u00e1te Zimbra Open-Source be\u017eiacu na multi-serverovej infra\u0161trukt\u00fare, budete musie\u0165 vykona\u0165 v\u0161etky ni\u017e\u0161ie uveden\u00e9 kroky na uzle s nain\u0161talovan\u00fdm Proxy serverom Zimbra. Okrem toho budete potrebova\u0165 zhoduj\u00face sa p\u00e1ry certifik\u00e1t+k\u013e\u00fa\u010d, ako aj d\u00f4veryhodn\u00e9 re\u0165azce certifik\u00e1tov od v\u00e1\u0161ho certifika\u010dn\u00e9ho centra pre ka\u017ed\u00fa z dom\u00e9n, ktor\u00e9 chcete umiestni\u0165 na svoju IPv4 adresu. Upozor\u0148ujeme, \u017ee v\u00e4\u010d\u0161ina ch\u00fdb pri nastavovan\u00ed SNI v Zimbra OSE vypl\u00fdva pr\u00e1ve z nespr\u00e1vnych s\u00faborov s certifik\u00e1tmi. Preto odpor\u00fa\u010dame v\u0161etko starostlivo skontrolova\u0165 pred ich bezprostrednou in\u0161tal\u00e1ciou.<\/p>\n

Na za\u010diatok, aby SNI spr\u00e1vne fungovalo, je potrebn\u00e9 zada\u0165 pr\u00edkaz zmprov mcf zimbraReverseProxySNIEnabled TRUE<\/b> na uzle s Proxy serverom Zimbra a potom re\u0161tartova\u0165 slu\u017ebu Proxy pomocou pr\u00edkazu\u00a0zmproxyctl restart<\/b>.<\/p>\n

Za\u010dneme vytvoren\u00edm dom\u00e9nov\u00e9ho mena. Ako pr\u00edklad si vezmeme dom\u00e9nu company.ru<\/b> a po vytvoren\u00ed dom\u00e9ny si prec\u00edzn\u011b ujasn\u00edme n\u00e1zov virtu\u00e1lneho hostite\u013ea Zimbra a virtu\u00e1lnu IP adresu. Upozor\u0148ujeme, \u017ee n\u00e1zov virtu\u00e1lneho hostite\u013ea Zimbra mus\u00ed zodpoveda\u0165 n\u00e1zvu, ktor\u00fd mus\u00ed pou\u017e\u00edvate\u013e zada\u0165 do adresn\u00e9ho riadku prehliada\u010da na pr\u00edstup k dom\u00e9ne, ako aj s\u00fahlasi\u0165 s n\u00e1zvom uveden\u00fdm v certifik\u00e1te. Ako pr\u00edklad zoberieme n\u00e1zov virtu\u00e1lneho hostite\u013ea Zimbra mail.company.ru<\/b>, a ako virtu\u00e1lnu IPv4 adresu pou\u017eijeme adresu 1.2.3.4<\/b>.<\/p>\n

Potom sta\u010d\u00ed zada\u0165 pr\u00edkaz zmprov md company.ru zimbraVirtualHostName mail.company.ru zimbraVirtualIPAddress 1.2.3.4<\/b>, aby sme priradili virtu\u00e1lny hostite\u013e Zimbra k virtu\u00e1lnemu IP adresu<\/a>. Upozor\u0148ujeme, \u017ee ak sa server nach\u00e1dza za NAT alebo firewallom, je potrebn\u00e9 zabezpe\u010di\u0165, aby v\u0161etky po\u017eiadavky na dom\u00e9nu smerovali presne na priraden\u00fa extern\u00fa IP adresu, a nie na jeho adresu v lok\u00e1lnej sieti.<\/p>\n

Po dokon\u010den\u00ed v\u0161etk\u00e9ho zost\u00e1va u\u017e len skontrolova\u0165 a pripravi\u0165 certifik\u00e1ty dom\u00e9ny na in\u0161tal\u00e1ciu a potom ich nain\u0161talova\u0165.<\/p>\n

Ak bola vydanie certifik\u00e1tu na dom\u00e9nu \u00faspe\u0161n\u00e9, mali by ste ma\u0165 tri s\u00fabory s certifik\u00e1tmi: dva z nich s\u00fa re\u0165azce certifik\u00e1tov od v\u00e1\u0161ho certifika\u010dn\u00e9ho centra a jeden je priamy certifik\u00e1t na dom\u00e9nu. Okrem toho by ste mali ma\u0165 s\u00fabor s k\u013e\u00fa\u010dom, ktor\u00fd ste pou\u017eili na z\u00edskanie certifik\u00e1tu. Vytvorte samostatn\u00fa zlo\u017eku \/tmp\/company.ru<\/b> a umiestnite tam v\u0161etky dostupn\u00e9 s\u00fabory s k\u013e\u00fa\u010dmi a certifik\u00e1tmi. V\u00fdsledok by mal vyzera\u0165 nejako takto:<\/p>\n

ls \/tmp\/company.ru\ncompany.ru.key\n company.ru.crt\n company.ru.root.crt\n company.ru.intermediate.crt<\/code><\/pre>\n
\nPotom spoj\u00edme re\u0165azce certifik\u00e1tov do jedn\u00e9ho s\u00faboru pomocou pr\u00edkazu cat company.ru.root.crt company.ru.intermediate.crt >> company.ru_ca.crt<\/b> a uist\u00edme sa, \u017ee s certifik\u00e1tmi je v\u0161etko v poriadku pomocou pr\u00edkazu \/opt\/zimbra\/bin\/zmcertmgr verifycrt comm \/tmp\/company.ru\/company.ru.key \/tmp\/company.ru\/company.ru.crt \/tmp\/company.ru\/company.ru_ca.crt<\/b>. Po \u00faspe\u0161nom overen\u00ed certifik\u00e1tov a k\u013e\u00fa\u010da m\u00f4\u017eeme prist\u00fapi\u0165 k ich in\u0161tal\u00e1cii.<\/p>\n
Akon\u00e1hle sa rozhodneme za\u010da\u0165 in\u0161tal\u00e1ciu, najprv spoj\u00edme certifik\u00e1t na dom\u00e9nu a d\u00f4veryhodn\u00e9 re\u0165azce od certifika\u010dn\u00fdch centier do jedn\u00e9ho s\u00faboru. To sa rob\u00ed tie\u017e pomocou jedn\u00e9ho pr\u00edkazu vo forme\u00a0cat company.ru.crt company.ru_ca.crt >> company.ru.bundle<\/b>. Potom je potrebn\u00e9 vykona\u0165 pr\u00edkaz na to, aby sa v\u0161etky certifik\u00e1ty a k\u013e\u00fa\u010d ulo\u017eili do LDAP: \/opt\/zimbra\/libexec\/zmdomaincertmgr savecrt company.ru company.ru.bundle company.ru.key<\/b>, a potom nain\u0161talova\u0165 certifik\u00e1ty pomocou pr\u00edkazu \/opt\/zimbra\/libexec\/zmdomaincertmgr deploycrts<\/b>. Po nain\u0161talovan\u00ed sa certifik\u00e1ty a k\u013e\u00fa\u010d od dom\u00e9ny company.ru bud\u00fa uklada\u0165 do prie\u010dinka \/opt\/zimbra\/conf\/domaincerts\/company.ru<\/b>.\u00a0<\/p>\n
Opakovan\u00edm t\u00fdchto krokov s r\u00f4znymi dom\u00e9nov\u00fdmi menami, ale rovnakou IP adresou, je mo\u017en\u00e9 umiestni\u0165 nieko\u013eko stoviek dom\u00e9n na jednu IPv4 adresu. Pri tom je mo\u017en\u00e9 bez probl\u00e9mov pou\u017e\u00edva\u0165 certifik\u00e1ty od r\u00f4znych certifika\u010dn\u00fdch centier. Spr\u00e1vnos\u0165 v\u0161etk\u00fdch vykonan\u00fdch krokov je mo\u017en\u00e9 overi\u0165 v akomko\u013evek prehliada\u010di, kde by sa pre ka\u017ed\u00e9 virtu\u00e1lne meno hostite\u013ea mal zobrazi\u0165 jeho SSL certifik\u00e1t<\/a>.\u00a0<\/p>\n
Na v\u0161etky ot\u00e1zky t\u00fdkaj\u00face sa Zextras Suite m\u00f4\u017eete kontaktova\u0165 z\u00e1stupky\u0148u spolo\u010dnosti \u201eZextras\u201c Ekaterinu Triandafiliidi na e-mailovej adrese katerina@zextras.com
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4. \u0415\u0449\u0435 \u0432 2011 \u0433\u043e\u0434\u0443 IANA \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0430 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u044f\u0442\u044c \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u043b\u043e\u043a\u043e\u0432 \/8 \u0438\u0437 \u0441\u0432\u043e\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430, \u0430 \u0443\u0436\u0435 \u0432 2017 \u0433\u043e\u0434\u0443 \u0430\u0434\u0440\u0435\u0441\u0430 \u0437\u0430\u043a\u043e\u043d\u0447\u0438\u043b\u0438\u0441\u044c \u0438 \u0443 \u043d\u0438\u0445. \u041e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043d\u0435\u0445\u0432\u0430\u0442\u043a\u0443 IPv4-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441\u0442\u0430\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv6, \u043d\u043e \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 SNI, \u043a\u043e\u0442\u043e\u0440\u0430\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28761,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38313","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ako spr\u00e1vne nastavi\u0165 SNI v Zimbra OSE? | ProHoster","description":"Na za\u010diatku 21. storo\u010dia sa na pokraji vy\u010derpania nach\u00e1dzal tak\u00fd zdroj, ako adresy IPv4.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c SNI \u0432 Zimbra OSE? | ProHoster","og:description":"\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:55+00:00","article:modified_time":"2019-10-31T19:22:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38313","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:37:35","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:11:24","updated":"2026-02-08 20:37:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/38313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=38313"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/38313\/revisions"}],"predecessor-version":[{"id":157779,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/38313\/revisions\/157779"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/28761"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=38313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=38313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=38313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}