On Thu, Oct 22, 2026 at 03:30:34PM +0200, H.-Dirk Schmitt wrote:
> In difference to my ssl related configuration is:
> ssl = yes
> ssl_server_cert_file = /etc/dovecot/private/c42-client.cert.pem
> ssl_server_key_file = /etc/dovecot/private/c42-client.key.pem
> ssl_server_ca_file = /etc/ssl/certs/c42-srv-ca.crt
> ssl_min_protocol = TLSv1.2
> ssl_server {
> cert_file = /etc/ssl/c42/c42-client.cert.pem
> dh_file = /etc/dovecot/dh.pem
> key_file = /etc/ssl/private/c42-client.key.pem
> }
I think that's it. I only had the top-level ssl_server_* settings, I
did not have the ssl_server block. When I added that, I encountered the
reported failure:
# cat /etc/dovecot/conf.d/10-ssl.conf
ssl = yes
ssl_server_cert_file = /etc/tls/example.net.crt
ssl_server_key_file = /etc/tls/example.net.key
ssl_min_protocol = TLSv1.2
ssl_server {
key_file = /etc/tls/example.net.key
}
# generate-test-mail.sh | runuser -u vmail -g vmail -- /usr/lib/dovecot/deliver
-e -f mailer-daemon -a testuser -d testuser
doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf
line 8: key_file: open(/etc/tls/example.net.key) failed: Permission denied
Is it not sufficient for your configuration to list the ssl_server_*
settings and omit the ssl_server block? The docs don't indicate a need
to define an ssl_server block in a normal configuration:
https://doc.dovecot.org/2.4.5/core/config/ssl.html#configuration-overview
noah
