I am trying to install Dovecot for the very first time ever. As far as I see I do have Dovecot up and running already, but I am not happy about these selfsigned certificate that is assigned to.

I am trying to change this with my own corporate wildcard certificate, but it seems I am doing something wrong here. I need some help with this as it is security related and not really a basic installation thingy.

Well, what did I all do?

Inside the /tmp folder I have downloaded the Pfx (certificate including private key) file.

I used openssl to get the files I need:

openssl pkcs12 -in wildcard.pfx -nocerts -out wildcardkey.pem

(here I entered the import and PEM passwords - I now have an encrypted key)

openssl rsa -in wildcardkey.pem -out wildcardserver.key

(here I have the decrypted key)

openssl pkcs12 -in wildcard.pfx -clcerts -nokeys -out wildcardcert.pem
openssl pkcs12 -in wildcard.pfx -nodes -nokeys -out wildcardchain.pem

I moved wildcardcert and wildcardchain to: /etc/ssl/certs I moved wildcardkey.pem and wildcardserver.key to /etc/ssl/private

Now I have editted ssl_cert and ssl_key as follow:

ssl_cert = /etc/ssl/certs/wildcardchain.pem
ssl_key = /etc/ssl/private/wildcardserver.key

So, what am I doing wrong?

Now I get an error after restarting Dovecot:

lmtp(5935): Error: SSL context initialization failed, disabling SSL: Can't load SSL certificate: There is no valid PEM certificate.

What am I doing wrong?

Because my Postfix looks ok?

smtpd_tls_key_file = /etc/ssl/private/wildcardkey.pem
smtpd_tls_cert_file = /etc/ssl/certs/wildcardcert.pem;
smtpd_tls_CAfile = /etc/ssl/certs/wildcardchain.pem;
smtpd_tls_key_file = /var/lib/nginx/ssl_passwords.txt;

1 Answer 1


Ah well,

It seems the chain was not in a correct order. When I changed the root and intermediate order inside the wildcardchain.pem it worked fine.

Now, what I do with this question?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .