starttls doesn't work

[Brian E. Lavender]

On Tue, Jul 28, 2026 at 12:34:40AM +0200, Markus Gschwendt wrote:
> On Mon, 2026-07-27 at 12:31 -0700, Brian E. Lavender wrote:
> > TLS doesn't want to start on my mail server. Where should I look?
> > 
> > I recently updated to bookworm from buster. 
> > ...
> > 
> > root at medium:/etc/exim4/conf.d# find . -type f | xargs grep bigbrie
> > ./main/03_exim4-config_tlsoptions:MAIN_TLS_CERTIFICATE =
> > /etc/letsencrypt/live/bigbrie.com/fullchain.pem
> > ./main/03_exim4-config_tlsoptions:MAIN_TLS_PRIVATEKEY =
> > /etc/letsencrypt/live/bigbrie.com/privkey.pem
> > 
> > root at medium:/home/brian# ls -l
> > /etc/letsencrypt/archive/bigbrie.com/*49.pem
> > -rw-r--r-- 1 root root        1891 Jul  7 09:37
> > /etc/letsencrypt/archive/bigbrie.com/cert49.pem
> > -rw-r--r-- 1 root root        3870 Jul  7 09:37
> > /etc/letsencrypt/archive/bigbrie.com/chain49.pem
> > -rw-r--r-- 1 root root        5761 Jul  7 09:37
> > /etc/letsencrypt/archive/bigbrie.com/fullchain49.pem
> > -rw-r--r-- 1 root Debian-exim 1708 Jul  7 09:37
> > /etc/letsencrypt/archive/bigbrie.com/privkey49.pem
> 
> I remember I had some certificate troubles on that upgrade too.
> 
> My setup is more complex as I have separate certs per domain which are
> created, updated and monitored by a script.
> 
> At the end of this script I copy all new/changed certificates to a
> subdirectory in the exim config.
> 
> rsync -rL --delete /etc/letsencrypt/live/ /etc/exim4/ssl/
> chown root:Debian-exim -R /etc/exim4/ssl
> find /etc/exim4/ssl -type d -exec chmod 750 {} \;
> find /etc/exim4/ssl -type f -exec chmod 640 {} \;
> 
> 
> The directory /etc/exim4/ssl looks like this:
> 
> 4 drwxr-x--- 55 root Debian-exim 4096 27. Jul  06:30 ssl
> 
> And the directory per domain like this:
> 4 drwxr-x---  2 root Debian-exim 4096 27. Jul  06:30 smtp.example.com
> 
> 
> In the exim config I have
> (first check if cert for hostname exists
> otherwise use a fallback cert)
>  
> MAIN_TLS_CERTIFICATE = ${if
> exists{/etc/exim4/ssl/${tls_sni}/fullchain.pem}{/etc/exim4/ssl/${tls_sn
> i}/fullchain.pem}{/etc/exim4/ssl/mx01.example.com/fullchain.pem}}
> 
> 
> Or maybe an issue with dhparam?
> 
> .ifdef MAIN_TLS_ENABLE
> tls_on_connect_ports = 465
> tls_dhparam = /etc/ssl/dh4096.pem
> ...
> .endif

Thanks for the details! I had some issues with the exists keyword,
but I think I copied over some extra spaces within mutt.
 I started with one file in the `/etc/exim/ssl` folder that I created
 using the rsync method and permission changes. Start TLS does work
 now. Do you tie this script with certbot or the letsencrypt somehow?

Brian
-- 
Brian Lavender
https://www.brie.com/brian/

"There are two ways of constructing a software design. One way is to
make it so simple that there are obviously no deficiencies. And the other
way is to make it so complicated that there are no obvious deficiencies."

Professor C. A. R. Hoare
The 1980 Turing award lecture