I have an SSL certificate and key from a trusted CA (not self-signed). This gives me the following files on a Fedora system:
/etc/pki/tls/certs/mydomain.crt /etc/pki/tls/certs/mydomain.csr /etc/pki/tls/private/mydomain.key
My sendmail.mc file contains these lines:
define(`confCACERT_PATH', `/etc/pki/tls/certs')dnl define(`confCACERT', `/etc/pki/tls/certs/ca-bundle.crt')dnl define(`confSERVER_CERT', `/etc/pki/tls/certs/mydomain.crt')dnl define(`confSERVER_KEY', `/etc/pki/tls/private/mydomain.key')dnl
Note that I don't have any
.pem files that are commonly shown in examples of how to get TLS working in sendmail.
When I start sendmail, I get this error:
Aug 22 15:10:17 cs sendmail: STARTTLS=server, error: SSL_CTX_use_PrivateKey_file(/etc/pki/tls/private/mydomain.key) failed
I assume the reason for the error is it is looking for a
.pem file, but I only have a
.key file to give. Should I create a
.pem file? If so, how do I do it from my existing files? When I try to run
make mydomain.pem it wants to create a CSR from scratch.
As pointed out below, there was a password on the key file. I removed it using the
openssl command and sendmail was able to load the file. I also needed to start
saslauthd to get it all working.