starttls doesn't work

[Markus Gschwendt]

On Mon, 2026-07-27 at 12:31 -0700, Brian E. Lavender wrote:
> TLS doesn't want to start on my mail server. Where should I look?
> 
> I recently updated to bookworm from buster. 
> ...
> 
> root at medium:/etc/exim4/conf.d# find . -type f | xargs grep bigbrie
> ./main/03_exim4-config_tlsoptions:MAIN_TLS_CERTIFICATE =
> /etc/letsencrypt/live/bigbrie.com/fullchain.pem
> ./main/03_exim4-config_tlsoptions:MAIN_TLS_PRIVATEKEY =
> /etc/letsencrypt/live/bigbrie.com/privkey.pem
> 
> root at medium:/home/brian# ls -l
> /etc/letsencrypt/archive/bigbrie.com/*49.pem
> -rw-r--r-- 1 root root        1891 Jul  7 09:37
> /etc/letsencrypt/archive/bigbrie.com/cert49.pem
> -rw-r--r-- 1 root root        3870 Jul  7 09:37
> /etc/letsencrypt/archive/bigbrie.com/chain49.pem
> -rw-r--r-- 1 root root        5761 Jul  7 09:37
> /etc/letsencrypt/archive/bigbrie.com/fullchain49.pem
> -rw-r--r-- 1 root Debian-exim 1708 Jul  7 09:37
> /etc/letsencrypt/archive/bigbrie.com/privkey49.pem

I remember I had some certificate troubles on that upgrade too.

My setup is more complex as I have separate certs per domain which are
created, updated and monitored by a script.

At the end of this script I copy all new/changed certificates to a
subdirectory in the exim config.

rsync -rL --delete /etc/letsencrypt/live/ /etc/exim4/ssl/
chown root:Debian-exim -R /etc/exim4/ssl
find /etc/exim4/ssl -type d -exec chmod 750 {} \;
find /etc/exim4/ssl -type f -exec chmod 640 {} \;


The directory /etc/exim4/ssl looks like this:

4 drwxr-x--- 55 root Debian-exim 4096 27. Jul  06:30 ssl

And the directory per domain like this:
4 drwxr-x---  2 root Debian-exim 4096 27. Jul  06:30 smtp.example.com


In the exim config I have
(first check if cert for hostname exists
otherwise use a fallback cert)
 
MAIN_TLS_CERTIFICATE = ${if
exists{/etc/exim4/ssl/${tls_sni}/fullchain.pem}{/etc/exim4/ssl/${tls_sn
i}/fullchain.pem}{/etc/exim4/ssl/mx01.example.com/fullchain.pem}}


Or maybe an issue with dhparam?

.ifdef MAIN_TLS_ENABLE
tls_on_connect_ports = 465
tls_dhparam = /etc/ssl/dh4096.pem
...
.endif