How to set web server mode on Zimbra mail

Zimbra To make webmail work over http, https, or both, change its operating mode using the steps below.

Run the command below to change the Zimbra web server mode: zmtlsctl [mode] For example: To use webmail over http only, run: [zimbra@mail ~]$ zmtlsctl http To use webmail over https only, run: [zimbra@mail ~]$ zmtlsctl https To use webmail over both http and https, run: [zimbra@mail ~]$ zmtlsctl both
Run the command below to restart the mailbox system: [zimbra@mail ~]$ zmmailboxdctl restart

zmtlsctl modes

http - Enable only port 80 (http://webmail)
https - Enable only port 443 (https://webmail)
both - Enable both port 80 (http://webmail) and 443 (https://webmail)
mixed - When accessed through http://webmail, the system switches to https://webmail for login, then returns to
http://webmail as usual. If accessed through https://webmail, it continues using https://webmail as usual.
redirect - Similar to mixed mode, but when accessed through http://webmail, the system switches to https://webmail.

Limitations of redirect mode

zimbraMailMode redirect only applies to Zimbra Web Client versions Advanced (AJAX), Standard HTML, and Mobile/XHTML. We will make a best effort for any of our connectors such as ZCO to as well within the limitations of the applications.
Many client applications will send an auth request in the initial HTTP request to the server (“blind auth”). The implications of this are that this auth request will be sent in the clear/unencrypted prior to any possible opportunity to redirect the client app to HTTPS.
Redirect mode allows for the possibility of a man-in-the-middle attack, intentional/unintentional redirection to a non-valid server, or the possibility that a user will mistype the server name and not have certificate-based validity of the server.
In many client apps, it is impossible for the user to tell if they have been redirected (for example, ActiveSync), and therefore will continue to use HTTP even if the auth request is being sent unencrypted. (iPhone does have a bug open with apple about this).
In short, only zimbraMailMode https can ensure that no listener will be available on HTTP/port 80, that no client apps will try to auth over HTTP, and that all data exchanged with client application will be encrypted.

Related notes