Postfix chained ssl cert permission denied

Question

I have a primary ssl cert and a chained ssl cert in the same directory, with the exact same permissions and ownership. I have Dovecot setup to use that chained cert file. It works fine. If I use the primary (non chained) cert, I have a mail client which cannot talk to Dovecot. I have Postfix using the primary cert, and it seems happy enough with that based on my tests, by my understanding was that I can run into trouble if I don't use a chained cert there too. There are many sources verifying this e.g. https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=SO17341&actp=AGENT_REFERAL

When I change Postfix to use the chain cert, however, it chokes and complains about permission errors that make no sense. This appears in my mail log:

Oct 10 15:06:07 XXXXXXXXX postfix/submission/smtpd[31154]: warning: cannot get RSA certificate from file /usr/etc/ssl/certs/XXXXXXXX/XXXXXXXXX-chained.crt: disabling TLS support
Oct 10 15:06:07 XXXXXXXXX postfix/submission/smtpd[31154]: warning: TLS library problem: 31154:error:0200100D:system library:fopen:Permission denied:bss_file.c:398:fopen('/usr/etc/ssl/certs/XXXXXXXX/XXXXXXXXX-chained.crt','r'):

As I said, the permissions are identical for the file it's happy with vs this one, and Dovecot has no such issue. What am I missing?

Answer 1

Solved. It's just a matter of the file extension! Postfix refuses to use the chained cert unless it has a .pem extension. It's not picky regarding the non-chained version, and other servers don't care about this detail. That's pretty weak... At least the fix is painless!

(BTW, Dovecot is fine with .pem if you want to be consistent when using both.)