I stumbled on to this recently, so I thought I'd pass it on in case it helps someone.
I have a virtualised Zimbra NE server.
The server is broken up into three disk images and one NFS mount
/ - Base Ubuntu os
/opt/zimbra - Obvious
/opt/zimbra/backup - NFS to a larger machine
I have dnsmasq running on the machine so host $(hostname) always resolves to 127.0.0.1.
This means I can replicate the VM, give it another IP address and it still thinks it is the zimbra server.
I deny this machine access to the outside world, so it never uses up any license activations while I play with it.
I then perform a full system upgrade giving the --skip-activation-check option to install.sh.
This allows a full upgrade to proceed without requiring activation of the license prior to the upgrade, so if for any reason I decide not to push the upgrade to the production server, I've not harmed my license in any way.
The dnsmasq trick has been a godsend, as it means I can replicate the VM and perform all sorts of testing on it without fear of any zimbra services connecting to the production machine, yet it's just a direct clone of the production machine. It also means the only downtime on the production box is a quick blip while I copy the disk images. I can then just play with the clones until I'm ready to do the upgrade.