Ok, I managed to screw up my email server. Release 7.2.1_GA_2790.DEBIAN5_64 DEBIAN5_64 FOSS edition.
I noticed one of my email clients complaining about a certificate error, so I logged in to the web client and viewed the certificates in IE. There were two, and the root one expired today. Ok, no problem, I just need to update the certificates, I thought. But when I opened up the admin console, I saw the certificates for the four services (mta, proxy, mailboxd, and ldap) were set to expire next year, and I didn't see any reference to the root cert that was causing my issue.
So I found this thread for updating certificates, and tried running the steps involved.
Now, I'm not entirely sure how I managed to screw this up so completely, but I kept getting an error when the services tried to come back up, starting with LDAP, reporting a strange error: "ldap_url and ldap_master_url cannot be the same on an ldap replica". A whole lot of searching revealed that the culprit was probably the localconfig.xml file, and when I looked at it, somewhere along the way it had been completely wiped out. (I think it was when I saw "Host localhost" being reported and found a thread saying this should be a real FQDN, and I set it while logged in as root. At least, I later found hints that this might be the case, and the fact that the only setting that remained in localconfig.xml was the hostname is a big clue.)
The certificates thread referenced above suggests that reinstalling the current version on top of itself will do the work of recreating certificates as needed, so I tried going down that path. Unbeknownst to me at the time, the first thing the upgrade process does is copy your current localconfig.xml into a .saveconfig directory, so I ended up overwriting that (my only potential backup copy) with the mostly-empty config when I tried to upgrade it over itself.
I moved my installation to a new directory and reinstalled a fresh installation, just so I could get a working localconfig.xml file. This mostly worked, though the passwords stored in localconfig.xml for LDAP are different than what they should be. Right after I see "Starting ldap...Done", the line "Unable to determine enabled services from ldap" gives me a clue that something's wrong. The logger service is the most helpful in showing this, as when it attempts to start, it shows a message "LDAP: error code 49 - Invalid Credentials".
There are six instances of the password in the localconfig.xml, for the keys ldap_postfix_password, ldap_amavis_password, ldap_replication_password, ldap_root_password, ldap_nginx_password, and zimbra_ldap_password, and they're all identical, which gives me hope that if I manage to find one, I'll find them all. Or, if there were a way to reset them all, then I could put that value into the localconfig.xml entries and be done.
Running zmldappasswd, though, gives me the error "TLS: SSL connect attempt failed with unknown errorerror:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed". Thinking it may be the certificates issue, I tried the script from that other forum thread yet again, but it was not successful (failed to set keys such as zimbraSSLCertificate, and invalid credentials from LDAP running zmupdateauthkeys). Fortunately, I managed not to wipe the localconfig.xml file again.
So this seems to be the last step in getting my server back. Can anyone assist in resetting the LDAP passwords before I tear what's left of my hair out?