The Email Clients Experience Issues After Zimbra Update: Zimbra Daffodil 10.0.2, 9.0.0 Patch-34 & 8.8.15 Patch-41

After patching Zimbra Daffodil to version 10.0.2, 9.0.0 Patch-34 & 8.8.15 Patch-41, some email clients like Outlook experienced access issues. This was due to updates made to the used OpenSSL. Considering that many users are still using older versions of email clients, I have decided to temporarily use weak ciphers. Then gradually upgrade the version of Outlook being used

Warning: Disabling FIPS and enabling weak ciphers is strongly not recommended. Use this workaround as a temporary solution. Please upgrade your email clients as soon as possible.

For this process, I followed the guidelines from the Zimbra forum.

# Method 1: Adding SECLEVEL=0 to zimbraReverseProxySSLCiphers

Get current configuration

zmprov gcf zimbraReverseProxySSLCiphers

Below is my current configuration


zimbraReverseProxySSLCiphers: ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:TLS_AES_256_GCM_SHA384:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4

Add the text “:@SECLEVEL=0” at the end

zmprov mcf zimbraReverseProxySSLCiphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:TLS_AES_256_GCM_SHA384:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4:@SECLEVEL=0'

Restart zimbra services

zmcontrol restart

# Method 2: Adding Configuration to the openssl.cnf File

Run as root. Disable FIPS provider

cd /opt/zimbra/common/etc/ssl
cp openssl-source.cnf openssl.cnf

Open openssl.cnf file

vi /opt/zimbra/common/etc/ssl/openssl.cnf

Add the following line at the bottom

SECLEVEL=0

[openssl_init]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
CipherString = DEFAULT:@SECLEVEL=0

Restart zimbra services

su - zimbra -c 'zmcontrol restart'

# Method 3: Replace OpenSSL

I manually compiled OpenSSL to support weak ciphers and 3DES.

Download OpenSSL that has been compiled from here: https://github.com/imanudin11/downloads. Please adjust with your OS. Save it on /opt folder

For example, I use Ubuntu 20.04

Run as Root. Disable FIPS Provider

cd /opt/zimbra/common/etc/ssl
cp openssl-source.cnf openssl.cnf

Backup the current libssl

mkdir /opt/zimbra/common/lib/backup-openssl/
cp /opt/zimbra/common/lib/libcrypto.so.3 /opt/zimbra/common/lib/backup-openssl/libcrypto.so.3-`date +"%Y%m%d%H%M%S"`
cp /opt/zimbra/common/lib/libssl.so.3 /opt/zimbra/common/lib/backup-openssl/libssl.so.3-`date +"%Y%m%d%H%M%S"`

Replace OpenSSL

cd /opt/
tar -xvf openssl309-ubuntu20.tgz
cd /opt/openssl309/lib64/
cp libssl.so.3 /opt/zimbra/common/lib/

Restart zimbra services

su - zimbra -c 'zmcontrol restart'

If there are issues when restarting the Zimbra, try copying the libcrypto.so.3 file as well and then restarting the service

cp libcrypto.so.3 /opt/zimbra/common/lib/

– Testing

Check if 3DES is already available.

openssl ciphers -v ALL | grep -i 3des

Test connection

openssl s_client -connect `hostname -f`:993 -tls1
openssl s_client -connect `hostname -f`:993 -tls1_1

Good luck 🙂

Source:
– NEW! Patch for Zimbra Daffodil 10.0.2, 9.0.0 Patch-34 & 8.8.15 Patch-41
– Zimbra 8.8.15 Patch-41 released, share your experience