{"id":473,"date":"2016-08-22T15:10:01","date_gmt":"2016-08-22T19:10:01","guid":{"rendered":"http:\/\/www.amixa.com\/blog\/?p=473"},"modified":"2016-08-22T15:10:01","modified_gmt":"2016-08-22T19:10:01","slug":"kerio-mailserver-csr-generation-and-import-of-ssl-cert","status":"publish","type":"post","link":"https:\/\/www.amixa.com\/blog\/2016\/08\/22\/kerio-mailserver-csr-generation-and-import-of-ssl-cert\/","title":{"rendered":"Kerio Mailserver CSR generation and import of SSL Cert"},"content":{"rendered":"

This is the entire process from CSR generation to installing the CRT with all trusted intermediate certs so that your connection is a good as possible.<\/p>\n

The primary reason for this article is due to issues that Google Gmail has with remote POP mail checking if the SSL and all Intermediate Certs aren’t installed.<\/p>\n

Note: This applicable for Kerio Mailserver 6.X and earlier.\u00a0 I cannot verify if it 100% works with 7.0 or newer.<\/p>\n

Generating the new CSR Certificate Signing Request from Kerio<\/strong><\/p>\n

    \n
  1. download the Kerio SSL tool here<\/a><\/li>\n
  2. extract that file to a new directory off your C:\\ root, something easy like “C:\\SSL”<\/li>\n
  3. inside the Kerio interface, go to the SSL Certs config page and<\/li>\n
  4. New->New Certificate Request<\/li>\n
  5. complete it and make sure your hostname is your full domain name to be protected by the SSL, eg “mail.yourdomainname.com”<\/li>\n
  6. save this file into the new directory above.<\/li>\n
  7. Run the following command from a command line.\u00a0 Feel free to change the bits if needed.\u00a0 We only use 4096\n
      \n
    1. openssl genrsa -out server.key 4096<\/strong><\/li>\n
    2. This will output a file called “server.key”<\/li>\n<\/ol>\n<\/li>\n
    3. Run the following command:\n
        \n
      1. openssl req -new -days 365 -key server.key -out server.csr -config openssl.cfg<\/strong><\/li>\n<\/ol>\n<\/li>\n
      2. That will generate a file called “server.csr”. You will need this for Godaddy, Comodo or wherever you get the SSL cert<\/li>\n<\/ol>\n

         <\/p>\n

        Buy a new SSL and use the “server.csr” file to process it.<\/p>\n

         <\/p>\n

        Handling the installation of your new CRT and installing intermediate keys as well.<\/strong><\/p>\n

          \n
        1. extract the zip file with your new CRT file into the directory above<\/li>\n
        2. you will need to locate and download the “intermediate certificates” for your SSL if they do not already come inside the zip file.\u00a0 In my case, we had an “Comodo Instant SSL” and inside it there was our domain CRT file and a second file “mail_mydomainname_com.ca-bundle”.\u00a0 I used the contents of this “ca-bundle” file for my needs.<\/li>\n
        3. using a text editor like “Ultraedit” or “Notepad++”\u00a0 (NOTE: DON’T USE NOTEPAD., open the .CRT file.<\/li>\n
        4. Copy it<\/li>\n
        5. paste it into a new blank document<\/li>\n
        6. open the additional file(s)<\/li>\n
        7. Paste them directly below your .CRT file text, into the text file.\u00a0 If there is more than one past them back to back to back in the file.\u00a0 Note: your domain CRT must be the first one, followed by the Int. certs.<\/li>\n
        8. \u00a0Save the file.\u00a0 Call it something mydomainname with extras.CRT<\/li>\n
        9. open Kerio<\/li>\n
        10. SSL Certs<\/li>\n
        11. Import New Cert<\/li>\n
        12. first it will ask for the KEY file you generated in the first section above.\u00a0 locate that file and open it<\/li>\n
        13. second it will be looking for our new combined CRT file that we just did in this section above.<\/li>\n
        14. once it imports, select the new cert as the active cert<\/li>\n
        15. restart kerio mailserver<\/li>\n
        16. go to this site<\/a> and run a test on your domainname.<\/li>\n
        17. if you’ve done everything properly, you should have all “Green Checkmarks” and a clean bill of health on your domain name.<\/li>\n<\/ol>\n

           <\/p>\n","protected":false},"excerpt":{"rendered":"

          This is the entire process from CSR generation to installing the CRT with all trusted intermediate certs so that your connection is a good as possible. The primary reason for this article is due to issues that Google Gmail has with remote POP mail checking if the SSL and all Intermediate Certs aren’t installed. Note: This applicable for Kerio Mailserver<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,22],"tags":[123],"class_list":["post-473","post","type-post","status-publish","format-standard","hentry","category-random-bits","category-windows-server","tag-kerio-mailserver"],"_links":{"self":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/comments?post=473"}],"version-history":[{"count":1,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/473\/revisions"}],"predecessor-version":[{"id":474,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/posts\/473\/revisions\/474"}],"wp:attachment":[{"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/media?parent=473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/categories?post=473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.amixa.com\/blog\/wp-json\/wp\/v2\/tags?post=473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}