Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an SSL certificate and key from a trusted CA (not self-signed). This gives me the following files on a Fedora system:


My file contains these lines:

define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl
define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl
define(`confSERVER_CERT', `/etc/pki/tls/certs/mydomain.crt')dnl
define(`confSERVER_KEY', `/etc/pki/tls/private/mydomain.key')dnl

Note that I don't have any .pem files that are commonly shown in examples of how to get TLS working in sendmail.

When I start sendmail, I get this error:

Aug 22 15:10:17 cs sendmail[23424]: STARTTLS=server, error: SSL_CTX_use_PrivateKey_file(/etc/pki/tls/private/mydomain.key) failed

I assume the reason for the error is it is looking for a .pem file, but I only have a .key file to give. Should I create a .pem file? If so, how do I do it from my existing files? When I try to run make mydomain.pem it wants to create a CSR from scratch.


As pointed out below, there was a password on the key file. I removed it using the openssl command and sendmail was able to load the file. I also needed to start saslauthd to get it all working.

share|improve this question
up vote 3 down vote accepted

That looks correct, the .pem file is the certificate or public key and can also be .cer or .crt as far as I'm aware. See this similar post for more information.

Regarding the actual error, does the key have a password associated with it? Do you definitely have the files the right away around? The .key should start with ---BEGIN PRIVATE KEY--- and the .crt should start with ---BEGIN CERTIFICATE---

share|improve this answer
Yes, there's a password on it. It's the same certificate used for the web server. Is that the problem? – Barry Brown Aug 22 '10 at 23:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.