su - zimbra zmcertmgr viewdeployedcrt # Check current expiry zmcertmgr renewcrt # Force renewal if within threshold Or restart sccfd – it will check on startup:
zmproxyctl reload zmmailboxdctl restart # if single-server If you manage certificates manually or via another CA: zimbra sccfd
su - zimbra zmlocalconfig | grep -i sccfd | Parameter | Default | Description | |-----------|---------|-------------| | ssl_allow_untrusted_certs | false | Allow self-signed (not recommended) | | ssl_sccfd_check_interval | 86400 | Check interval in seconds (1 day) | | ssl_sccfd_renew_threshold | 30 | Renew when days left ≤ this value | | ssl_sccfd_random_delay_max | 3600 | Random delay before check (seconds) | Modify a parameter: zmlocalconfig -e ssl_sccfd_renew_threshold=20 Then restart sccfd : su - zimbra zmcertmgr viewdeployedcrt # Check current