starttls doesn't work

[Markus Gschwendt]

On Tue, 2026-07-28 at 01:01 +0000, Andrew Hodgson wrote:
> Markus Gschwendt wrote:
> 
> > On Mon, 2026-07-27 at 12:31 -0700, Brian E. Lavender wrote:
> > >  /etc/letsencrypt/archive/bigbrie.com/*49.pem
> > > -rw-r--r-- 1 root root        1891 Jul  7 09:37 
> > > /etc/letsencrypt/archive/bigbrie.com/cert49.pem
> > > -rw-r--r-- 1 root root        3870 Jul  7 09:37 
> > > /etc/letsencrypt/archive/bigbrie.com/chain49.pem
> > > -rw-r--r-- 1 root root        5761 Jul  7 09:37 
> > > /etc/letsencrypt/archive/bigbrie.com/fullchain49.pem
> > > -rw-r--r-- 1 root Debian-exim 1708 Jul  7 09:37 
> > > /etc/letsencrypt/archive/bigbrie.com/privkey49.pem
> 
> > If I remember correctly, for exim the
> > certificates should not be readable by 'others'. I have:
> 
> [...]
> 
> > This is the reason I copy the files from the letsencrypt dirs so I
> > can set permissions which are accepted by exim.
> 
> I used to do it that way but last time I did this on a Ubuntu 24.04
> system I followed a guide which set up the directories with perms
> that Exim liked.
> 
> HOSTNAME=elrond.hodgson.io
> GROUPNAME=Debian-exim
> DIRECTORIES="/etc/letsencrypt/live /etc/letsencrypt/live/$HOSTNAME
> /etc/letsencrypt/archive /etc/letsencrypt/archive/$HOSTNAME"
> sudo chmod 640 /etc/letsencrypt/live/$HOSTNAME/privkey.pem
> sudo chmod 750 $DIRECTORIES
> sudo chgrp $GROUPNAME $DIRECTORIES
> /etc/letsencrypt/live/$HOSTNAME/privkey.pem
> 

This should work too.

But I wouldn't recommend to mess with ownership and permissions in
directories belonging to another package. Like changing the group.
Eg consider dovecot/nginx/... is using those directories/files too. And
what if in the certbot/dehydrated/... packages changes something (check
for ownership, permissions)?

I think copying the certificate files is a more future proof and more
clean approach.

Otherwise the package maintainers should look into this and maybe fix
the problem so exim can use the files in /etc/letsencrypt/... out of
the box.


Markus