starttls doesn't work

[Brian E. Lavender]

TLS doesn't want to start on my mail server. Where should I look?

I recently updated to bookworm from buster. 

This is what I checked thus far.

root at medium:/etc/letsencrypt/archive/bigbrie.com# swaks --tls -q HELO -s localhost
=== Trying localhost:25...
=== Connected to localhost.
<-  220 medium.bigbrie.com ESMTP Exim 4.96 Mon, 27 Jul 2026 12:23:33 -0700
 -> EHLO medium.bigbrie.com
<-  250-medium.bigbrie.com Hello localhost [::1]
<-  250-SIZE 52428800
<-  250-8BITMIME
<-  250-PIPELINING
<-  250-PIPECONNECT
<-  250-CHUNKING
<-  250-STARTTLS
<-  250-PRDR
<-  250 HELP
 -> STARTTLS
<** 454 TLS currently unavailable

In my configuration, I have it linked to my certificates.

root at medium:/etc/exim4/conf.d# find . -type f | xargs grep bigbrie
./main/03_exim4-config_tlsoptions:MAIN_TLS_CERTIFICATE = /etc/letsencrypt/live/bigbrie.com/fullchain.pem
./main/03_exim4-config_tlsoptions:MAIN_TLS_PRIVATEKEY = /etc/letsencrypt/live/bigbrie.com/privkey.pem

root at medium:/home/brian# ls -l /etc/letsencrypt/archive/bigbrie.com/*49.pem
-rw-r--r-- 1 root root        1891 Jul  7 09:37 /etc/letsencrypt/archive/bigbrie.com/cert49.pem
-rw-r--r-- 1 root root        3870 Jul  7 09:37 /etc/letsencrypt/archive/bigbrie.com/chain49.pem
-rw-r--r-- 1 root root        5761 Jul  7 09:37 /etc/letsencrypt/archive/bigbrie.com/fullchain49.pem
-rw-r--r-- 1 root Debian-exim 1708 Jul  7 09:37 /etc/letsencrypt/archive/bigbrie.com/privkey49.pem


Brian
-- 
Brian Lavender
https://www.brie.com/brian/

"There are two ways of constructing a software design. One way is to
make it so simple that there are obviously no deficiencies. And the other
way is to make it so complicated that there are no obvious deficiencies."

Professor C. A. R. Hoare
The 1980 Turing award lecture