1

I have a weird problem. In Postfix I am having trouble with some new certificates. I have a .crt and .key file and when trying to use them in main.cf I get this in logs:

Sep 16 08:06:09 mx1 postfix/smtpd[25172]: warning: cannot get RSA certificate from file /etc/postfix/new.crt: disabling TLS support
Sep 16 08:06:09 mx1 postfix/smtpd[25172]: warning: TLS library problem: 25172:error:0200100D:system library:fopen:Permission denied:bss_file.c:402:fopen('/etc/postfix/new.crt','r'):

The weird thing is, the old certificates work fine and the permissions seem identical:

-rw-rw-r--.  1 root       root        2774 Sep 15  2018 old.crt
-rw-r--r--.  1 root       root        1675 Sep 15  2018 old.key
-rw-r--r--.  1 root       root        2228 Sep 16 07:51 new.crt
-rw-r--r--.  1 root       root        1675 Sep 16 07:52 new.key

Any ideas? Thanks.

  • 1
    Run ls -Z on those files. Most probably they have the wrong selinux context. – Gerald Schneider Sep 16 at 8:02
  • Ahh yes that was it! I changed them to match the old and its working now, thank you! :) – Ed Jones Sep 16 at 8:14
1

The . at the end of the permissions (-rw-r--r--.) denotes that there are extended SELinux permissions on the files that are not shown by a normal ls -l.

Run ls -Z on those files. Most probably they have the wrong SELinux context.

You can then set the correct SELinux context using chcon.

| improve this answer | |
  • 1
    It happens when you move instead of copy files. You can use mv -Z to have the context reset as part of the move, which prevents the problem. You can also copy the file then delete the original. – Michael Hampton Sep 17 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.