starttls doesn't work

[Andrew Hodgson]

Markus Gschwendt wrote:

>On Mon, 2026-07-27 at 12:31 -0700, Brian E. Lavender wrote:
>>  /etc/letsencrypt/archive/bigbrie.com/*49.pem
>> -rw-r--r-- 1 root root        1891 Jul  7 09:37 
>> /etc/letsencrypt/archive/bigbrie.com/cert49.pem
>> -rw-r--r-- 1 root root        3870 Jul  7 09:37 
>> /etc/letsencrypt/archive/bigbrie.com/chain49.pem
>> -rw-r--r-- 1 root root        5761 Jul  7 09:37 
>> /etc/letsencrypt/archive/bigbrie.com/fullchain49.pem
>> -rw-r--r-- 1 root Debian-exim 1708 Jul  7 09:37 
>> /etc/letsencrypt/archive/bigbrie.com/privkey49.pem

>If I remember correctly, for exim the
>certificates should not be readable by 'others'. I have:

[...]

>This is the reason I copy the files from the letsencrypt dirs so I can set permissions which are accepted by exim.

I used to do it that way but last time I did this on a Ubuntu 24.04 system I followed a guide which set up the directories with perms that Exim liked.

HOSTNAME=elrond.hodgson.io
GROUPNAME=Debian-exim
DIRECTORIES="/etc/letsencrypt/live /etc/letsencrypt/live/$HOSTNAME /etc/letsencrypt/archive /etc/letsencrypt/archive/$HOSTNAME"
sudo chmod 640 /etc/letsencrypt/live/$HOSTNAME/privkey.pem
sudo chmod 750 $DIRECTORIES
sudo chgrp $GROUPNAME $DIRECTORIES /etc/letsencrypt/live/$HOSTNAME/privkey.pem

Thanks.
Andrew.