starttls doesn't work

[Markus Gschwendt]

On Mon, 2026-07-27 at 17:37 -0700, Brian E. Lavender wrote:
> On Tue, Jul 28, 2026 at 12:34:40AM +0200, Markus Gschwendt wrote:
> > On Mon, 2026-07-27 at 12:31 -0700, Brian E. Lavender wrote:
> > > TLS doesn't want to start on my mail server. Where should I look?
> > > 
> > > I recently updated to bookworm from buster. 
> > > ...
> > > 
> > > root at medium:/etc/exim4/conf.d# find . -type f | xargs grep
> > > bigbrie
> > > ./main/03_exim4-config_tlsoptions:MAIN_TLS_CERTIFICATE =
> > > /etc/letsencrypt/live/bigbrie.com/fullchain.pem
> > > ./main/03_exim4-config_tlsoptions:MAIN_TLS_PRIVATEKEY =
> > > /etc/letsencrypt/live/bigbrie.com/privkey.pem
> > > 
> > > root at medium:/home/brian# ls -l
> > > /etc/letsencrypt/archive/bigbrie.com/*49.pem
> > > -rw-r--r-- 1 root root        1891 Jul  7 09:37
> > > /etc/letsencrypt/archive/bigbrie.com/cert49.pem
> > > -rw-r--r-- 1 root root        3870 Jul  7 09:37
> > > /etc/letsencrypt/archive/bigbrie.com/chain49.pem
> > > -rw-r--r-- 1 root root        5761 Jul  7 09:37
> > > /etc/letsencrypt/archive/bigbrie.com/fullchain49.pem
> > > -rw-r--r-- 1 root Debian-exim 1708 Jul  7 09:37
> > > /etc/letsencrypt/archive/bigbrie.com/privkey49.pem
> > 
> > I remember I had some certificate troubles on that upgrade too.
> > 
> > My setup is more complex as I have separate certs per domain which
> > are
> > created, updated and monitored by a script.
> 
...

> Thanks for the details! I had some issues with the exists keyword,
> but I think I copied over some extra spaces within mutt.

The line should not have line breaks.

>  I started with one file in the `/etc/exim/ssl` folder that I created
>  using the rsync method and permission changes. Start TLS does work
>  now. Do you tie this script with certbot or the letsencrypt somehow?

Great it works!

My script is run by cron daily,
It cares about certificates for exim, dovecot and nginx.
Virtual exim users are in a database. The script uses the domain
information from this database. It creates missing certs and does
trigger renewal some weeks before expiry.
For dovecot the script generates a config file.