{"id":38313,"date":"2019-10-31T22:22:55","date_gmt":"2019-10-31T19:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-pravilno-nastroit-sni-v-zimbra-ose\/"},"modified":"2019-10-31T22:22:55","modified_gmt":"2019-10-31T19:22:55","slug":"kak-pravilno-nastroit-sni-v-zimbra-ose","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","title":{"rendered":"Hur konfigurerar man SNI korrekt i Zimbra OSE?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I b\u00f6rjan av 2000-talet var en resurs som IPv4-adresser n\u00e4ra att ta slut. Redan \u00e5r 2011 tilldelade IANA de senaste fem kvarvarande \/8-blocken ur sitt adressutrymme till regionala internetregistratorer, och redan 2017 tog \u00e4ven de slut p\u00e5 adresser. Som svar p\u00e5 den katastrofala bristen p\u00e5 IPv4-adresser kom inte bara protokollet IPv6, utan \u00e4ven teknologin SNI, som m\u00f6jliggjorde att ett stort antal webbplatser kunde hostas p\u00e5 en och samma IPv4-adress. SNI fungerar genom att det h\u00e4r till\u00e4gget l\u00e5ter klienter under handskakningen meddela servern namnet p\u00e5 webbplatsen de vill ansluta till. Detta till\u00e5ter servern att lagra flera certifikat och d\u00e4rf\u00f6r hantera m\u00e5nga dom\u00e4ner p\u00e5 en och samma IP-adress. Speciellt efterfr\u00e5gad blev SNI-teknologin bland SaaS-leverant\u00f6rer f\u00f6r f\u00f6retag, vilket gav dem m\u00f6jlighet att hosta i stort sett obegr\u00e4nsat med dom\u00e4ner utan att beh\u00f6va ta h\u00e4nsyn till det antal IPv4-adresser som kr\u00e4vs. L\u00e5t oss ta reda p\u00e5 hur vi kan implementera st\u00f6d f\u00f6r SNI i Zimbra Collaboration Suite Open-Source Edition.<\/p>\n

\"Hur<\/a><\/noindex><\/p>\n

SNI fungerar i alla aktuella och st\u00f6dda versioner av Zimbra OSE. Om du har Zimbra Open-Source som k\u00f6rs p\u00e5 en multiservarinfrastruktur, beh\u00f6ver du f\u00f6lja alla nedanst\u00e5ende steg p\u00e5 noden med den installerade Zimbra Proxy-servern. Dessutom beh\u00f6ver du matchande certifikat+nyckel-par samt betrodda certifikatkedjor fr\u00e5n ditt certifikatcenter f\u00f6r varje dom\u00e4n som du vill hosta p\u00e5 din IPv4-adress. Observera att den \u00f6verv\u00e4gande anledningen till de flesta fel vid konfigurationen av SNI i Zimbra OSE beror p\u00e5 felaktiga certifikatfiler. D\u00e4rf\u00f6r rekommenderar vi att noggrant kontrollera allt innan du installerar dem.<\/p>\n

F\u00f6rst och fr\u00e4mst, f\u00f6r att SNI ska fungera korrekt m\u00e5ste du ange kommandot zmprov mcf zimbraReverseProxySNIEnabled TRUE<\/b> p\u00e5 noden med Zimbra Proxy-servern, och sedan starta om Proxy-tj\u00e4nsten med kommandot\u00a0zmproxyctl restart<\/b>.<\/p>\n

Vi b\u00f6rjar med att skapa ett dom\u00e4nnamn. Som exempel tar vi dom\u00e4nen company.ru<\/b> Och efter att dom\u00e4nen har skapats, l\u00e5t oss best\u00e4mma namnet p\u00e5 den virtuella v\u00e4rden Zimbra och den virtuella IP-adressen. Observera att namnet p\u00e5 den virtuella v\u00e4rden Zimbra ska motsvara namnet som anv\u00e4ndaren skriver in i webbl\u00e4sarens adressf\u00e4lt f\u00f6r att f\u00e5 tillg\u00e5ng till dom\u00e4nen och \u00e4ven \u00f6verensst\u00e4mma med namnet som anges i certifikatet. Som exempel anv\u00e4nder vi namnet p\u00e5 den virtuella v\u00e4rden Zimbra. mail.company.ru<\/b>, och som virtuell IPv4-adress anv\u00e4nder vi adressen 1.2.3.4<\/b>.<\/p>\n

Efter detta r\u00e4cker det med att skriva in kommandot zmprov md company.ru zimbraVirtualHostName mail.company.ru zimbraVirtualIPAddress 1.2.3.4<\/b>, f\u00f6r att koppla den virtuella v\u00e4rden Zimbra till den virtuella IP-adress<\/a>. Observera att om servern befinner sig bakom NAT eller brandv\u00e4gg, m\u00e5ste man se till att alla f\u00f6rfr\u00e5gningar till dom\u00e4nen g\u00e5r till den offentliga IP-adressen som \u00e4r kopplad till den, och inte till dess adress i det lokala n\u00e4tverket.<\/p>\n

N\u00e4r allt \u00e4r klart, \u00e5terst\u00e5r det bara att kontrollera och f\u00f6rbereda dom\u00e4nens certifikat f\u00f6r installation, och sedan installera dem.<\/p>\n

Om certifikatet f\u00f6r dom\u00e4nen har utf\u00e4rdats korrekt, b\u00f6r du ha tre filer med certifikat: tv\u00e5 av dem \u00e4r certifikatkedjor fr\u00e5n din certifikatutf\u00e4rdare, och ett \u00e4r det faktiska certifikatet f\u00f6r dom\u00e4nen. Dessutom b\u00f6r du ha en fil med den nyckel som du anv\u00e4nde f\u00f6r att f\u00e5 certifikatet. Skapa en separat mapp \/tmp\/company.ru<\/b> och placera alla dina nyckel- och certifikatfiler d\u00e4r. Resultatet b\u00f6r bli n\u00e5got liknande detta:<\/p>\n

ls \/tmp\/company.ru\ncompany.ru.key\n company.ru.crt\n company.ru.root.crt\n company.ru.intermediate.crt<\/code><\/pre>\n
\nD\u00e4refter sammanfogar vi certifikatkedjorna till en fil med kommandot cat company.ru.root.crt company.ru.intermediate.crt >> company.ru_ca.crt<\/b> och s\u00e4kerst\u00e4ller att allt \u00e4r i ordning med certifikaten med hj\u00e4lp av kommandot \/opt\/zimbra\/bin\/zmcertmgr verifycrt comm \/tmp\/company.ru\/company.ru.key \/tmp\/company.ru\/company.ru.crt \/tmp\/company.ru\/company.ru_ca.crt<\/b>. N\u00e4r verifieringen av certifikaten och nyckeln \u00e4r framg\u00e5ngsrik kan installationen b\u00f6rja.<\/p>\n
F\u00f6r att p\u00e5b\u00f6rja installationen sammanfogar vi f\u00f6rst certifikatet f\u00f6r dom\u00e4nen och de betrodda kedjorna fr\u00e5n certifikatutf\u00e4rdarna till en fil. Det g\u00f6rs ocks\u00e5 med ett kommando av typen\u00a0cat company.ru.crt company.ru_ca.crt >> company.ru.bundle<\/b>. Efter detta m\u00e5ste vi k\u00f6ra kommandot f\u00f6r att skriva alla certifikat och nyckeln i LDAP: \/opt\/zimbra\/libexec\/zmdomaincertmgr savecrt company.ru company.ru.bundle company.ru.key<\/b>, och sedan installera certifikaten med kommandot \/opt\/zimbra\/libexec\/zmdomaincertmgr deploycrts<\/b>. Efter installation kommer certifikat och nyckel f\u00f6r dom\u00e4nen company.ru att lagras i mappen \/opt\/zimbra\/conf\/domaincerts\/company.ru<\/b>.\u00a0<\/p>\n
Genom att upprepa dessa steg med olika dom\u00e4nnamn men samma IP-adress kan man hosta flera hundra dom\u00e4ner p\u00e5 en och samma IPv4-adress. Dessutom kan man utan problem anv\u00e4nda certifikat fr\u00e5n olika utf\u00e4rdande myndigheter. Man kan kontrollera riktigheten av alla utf\u00f6rda \u00e5tg\u00e4rder i vilken webbl\u00e4sare som helst, d\u00e4r varje virtuellt v\u00e4rdnamn ska visa sin egen SSL-certifikat<\/a>.\u00a0<\/p>\n
F\u00f6r alla fr\u00e5gor relaterade till Zextras Suite kan ni kontakta f\u00f6retagets representant \"Zextras\", Ekaterina Triandafiliidi, via e-post katerina@zextras.com
\n
K\u00e4lla: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4. \u0415\u0449\u0435 \u0432 2011 \u0433\u043e\u0434\u0443 IANA \u0432\u044b\u0434\u0435\u043b\u0438\u043b\u0430 \u0440\u0435\u0433\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043f\u044f\u0442\u044c \u043e\u0441\u0442\u0430\u0432\u0448\u0438\u0445\u0441\u044f \u0431\u043b\u043e\u043a\u043e\u0432 \/8 \u0438\u0437 \u0441\u0432\u043e\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0430, \u0430 \u0443\u0436\u0435 \u0432 2017 \u0433\u043e\u0434\u0443 \u0430\u0434\u0440\u0435\u0441\u0430 \u0437\u0430\u043a\u043e\u043d\u0447\u0438\u043b\u0438\u0441\u044c \u0438 \u0443 \u043d\u0438\u0445. \u041e\u0442\u0432\u0435\u0442\u043e\u043c \u043d\u0430 \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u043d\u0435\u0445\u0432\u0430\u0442\u043a\u0443 IPv4-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441\u0442\u0430\u043b\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPv6, \u043d\u043e \u0438 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 SNI, \u043a\u043e\u0442\u043e\u0440\u0430\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28761,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38313","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hur st\u00e4ller man in SNI korrekt i Zimbra OSE? | ProHoster","description":"I b\u00f6rjan av 2000-talet var resurser som IPv4-adresser i farozonen f\u00f6r utt\u00f6mning.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c SNI \u0432 Zimbra OSE? | ProHoster","og:description":"\u0412 \u043d\u0430\u0447\u0430\u043b\u0435 21-\u0433\u043e \u0432\u0435\u043a\u0430 \u043d\u0430 \u0433\u0440\u0430\u043d\u0438 \u0438\u0441\u0442\u043e\u0449\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u043e\u0439 \u0440\u0435\u0441\u0443\u0440\u0441, \u043a\u0430\u043a \u0430\u0434\u0440\u0435\u0441\u0430 IPv4.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/kak-pravilno-nastroit-sni-v-zimbra-ose","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:22:55+00:00","article:modified_time":"2019-10-31T19:22:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38313","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:37:35","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:11:24","updated":"2026-02-08 20:37:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/38313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=38313"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/38313\/revisions"}],"predecessor-version":[{"id":157779,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/38313\/revisions\/157779"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/28761"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=38313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=38313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=38313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}