How to Fix Dovecot SSL Configuration Error

In this tutorial, you'll learn about How to Fix Dovecot SSL Configuration Error. We cover key concepts, practical examples, and best practices.

Dovecot fails to start with ssl_cert: Can't open file /etc/ssl/certs/dovecot.pem or SSL connections fail — the SSL certificate path is wrong or the files have incorrect permissions.

The Problem

Error: ssl_cert: Can't open file /etc/ssl/certs/dovecot.pem: No such file or directory
Fatal: Couldn't start SSL listener: Can't load SSL certificate

Step-by-Step Fix

Step 1: Create or copy SSL certificate

# Use Let's Encrypt
sudo ln -s /etc/letsencrypt/live/mail.example.com/fullchain.pem /etc/ssl/certs/dovecot.pem
sudo ln -s /etc/letsencrypt/live/mail.example.com/privkey.pem /etc/ssl/private/dovecot.pem

Step 2: Set correct permissions

sudo chmod 644 /etc/ssl/certs/dovecot.pem
sudo chmod 600 /etc/ssl/private/dovecot.pem
sudo chown root:root /etc/ssl/private/dovecot.pem

Step 3: Configure SSL in Dovecot

# /etc/dovecot/conf.d/10-ssl.conf
ssl = required
ssl_cert = </etc/ssl/certs/dovecot.pem
ssl_key = </etc/ssl/private/dovecot.pem
ssl_min_protocol = TLSv1.2
ssl_cipher_list = HIGH:!aNULL:!MD5
ssl_prefer_server_ciphers = yes

Step 4: Use Let's Encrypt with auto-renewal

# /etc/letsencrypt/renewal-hooks/deploy/dovecot.sh
#!/bin/bash
cp /etc/letsencrypt/live/mail.example.com/fullchain.pem /etc/ssl/certs/dovecot.pem
cp /etc/letsencrypt/live/mail.example.com/privkey.pem /etc/ssl/private/dovecot.pem
chmod 644 /etc/ssl/certs/dovecot.pem
chmod 600 /etc/ssl/private/dovecot.pem
systemctl restart dovecot

Step 5: Verify SSL

sudo openssl s_client -connect localhost:993

Expected:

* OK [CAPABILITY ...] Dovecot ready

Prevention Tips

• Set up certbot renewal hooks to copy certificates to Dovecot
• Monitor certificate expiry dates
• Use ssl_cert = </path (with < prefix) for file paths
• Test SSL with doveconf -n to verify all settings

Common Mistakes with ssl config

1. Non-exhaustive pattern matches that compile with warnings then crash at runtime
2. Misunderstanding that String is [Char] with poor performance for large text operations
3. Using foldl instead of foldl' causing stack overflow on large lists

These mistakes appear frequently in real-world DOVECOT code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ