Our mail server was originally set up using self-created certificates. However when those expired, and I tried to recreate them, the whole thing just blew up. Since I know it will be important, we are running a Debian server and postfix.

Now I see these errors generated in the mail logs:

May 15 08:06:34 letterpress postfix/smtpd[22901]: warning: cannot get certificate from file /etc/postfix/ssl/smtpd.cert
May 15 08:06:34 letterpress postfix/smtpd[22901]: warning: TLS library problem: 22901:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('/etc/postfix/ssl/smtpd.cert','r'):
May 15 08:06:34 letterpress postfix/smtpd[22901]: warning: TLS library problem: 22901:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354:
May 15 08:06:34 letterpress postfix/smtpd[22901]: warning: TLS library problem: 22901:error:140DC002:SSL routines:SSL_CTX_use_certificate_chain_file:system lib:ssl_rsa.c:720:
May 15 08:06:34 letterpress postfix/smtpd[22901]: cannot load RSA certificate and key data

And when trying to access email from a client like Thunderbird from outside our local network, you receive "Unable to connect to smtp server".

I have verified that the file /etc/postfix/ssl/smtpd.cert does exist. The current owner of the file is root:root. Does this need to be changed?

  • /etc/postfix/ssl/smtpd.cert is missing May 18, 2009 at 15:35

3 Answers 3


Your /etc/postfix/main.cf will contain the following three directives.


This tells Postfix to use TLS.

You can get it working again by disabling TLS, or creating new certificates.

Disabling TLS

  1. Change smtpd_use_tls from yes to no
  2. /etc/init.d/postfix restart

Creating new certificates

  1. Find the key file (according to smtpd_tls_key_file). If it is missing, you will have to create a new one. (openssl genrsa -out filename.key 1024; chmod 600 filename.key)
  2. Create a CSR (openssl req -new -key filename.key -out filename.csr)
  3. Create the certificate (openssl x509 -req -days 730 -in filename.csr -signkey filename.key -out filename.crt)
  4. Make it into the .pem format (cat filename.key filename.crt > filename.pem;chmod 600 filename.pem; chown postfix filename.pem)

Then ensure it is where it needs to be according to /etc/postfix/main.cf, and restart Postfix. You should be good to go.

  • @Brent - Why change it to a .pem format? Any links explaining what differentiates a pem file from the other key file formats would be great. I've wondered this for a very long time. May 19, 2009 at 2:19
  • Not sure why it uses a .pem format - that step may be unnecessary. As you can see, the pem format is just a concatenation of the .key and .crt files.
    – Brent
    May 19, 2009 at 12:03
  • Note that smtp_use-tls is now obsolete, should use ` smtpd_tls_security_level, with value may` to allow. Jan 26, 2010 at 11:40

It would appear as though you have an issue in "/etc/postfix/ssl/smtpd.cert", either the file is missing, the permissions on it are wrong, or the formatting of the certificate inside it is invalid.


I had this problem. It turned out the name of my private key was mailserver.pem and yet in postfix's configuration it was mailserver.key. I'd followed a tutorial which had both with a .pem extension.

I also had both the cert and private key readable only by root, and I changed this so that they were readable by both root and postfix (chown root:postfix filename; chmod 640 filename). Not sure if this second step is required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.