dovecot - Aug 2015 - Multidomain / IP Address Setup (Dovevot 2.2.10 on CentOS7 ) is failing: Fatal: Couldn't parse private ssl_key: error:0906D06C:PEM

Hi,
I want to say hello and here is my big problem ;D

Iam trying to archive a Postfix/Dovecot 2.2.10 CentOS7 Multidomain Setup 
with multiple (valid
StartSSL Certs), but iam only able to run a single Domain Cert server only.

ps: I need a multiple domainssetup for every customer and it is not an 
option for me redirecting any email
to a single domain server. I really need this setup working.

IMHO: I think it SELinux could interfere with multiple Certs in diffrent 
folders (it is activated in CentOs7 by
default and is needed by other apps)

Ok, here is my logfile data:

systemctl start postfix.service [OK]
systemctl start dovecot.service [OK]

/var/log/messages
*systemd: Stopping Dovecot IMAP/POP3 email server...
*systemd: Starting Dovecot IMAP/POP3 email server...
*systemd: Started Dovecot IMAP/POP3 email server.

/var/log/maillog
*dovecot: master: Dovecot v2.2.10 starting up for imap, pop3, lmtp (core 
dumps disabled)

### This works (Thunderbird, Outlook 2013, Opera Mail ect.) ####

local mydomain01.tld {

   protocol imap {
       ssl_cert = 
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem
       ssl_key = 
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem
   }

}

### this 10-ssl.conf ### --- FAILS (the error occurs after an email 
client accesses IMAP Folders)
local mydomain01.tld {

   protocol imap {
       ssl_cert = 
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem
       ssl_key = 
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem
   }

}

local mydomain02.tld {

   protocol imap {
       ssl_cert = 
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem
       ssl_key = 
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem
   }

}

/var/log/mailog ### Error log ###
Aug 14 12:50:38 matrix dovecot: imap-login: Fatal: Couldn't parse 
private ssl_key: error:0906D06C:PEM routines:PEM_read_bio:no start line:
Aug 14 12:50:38 matrix dovecot: master: Error: service(imap-login): 
command startup failed, throttling for 60 secs

I really dont know why a single domain is no problem but if i enable 
multiple domains dovecots
start with any error, even if i set debug verbose leven to extrem high 
but if i access dovecot with
Thunderbird my server loggile explodes with something like this Couldn't 
parse private ssl_key: error:0906D06C:PEM but the certs are 100% valid 
and checked over and over again.

Any help is greatly appreciated!

Greetings,
Dravion

Am 14.08.2015 um 13:22 schrieb dravion.smith at gmx.net:
> Hi,
> I want to say hello and here is my big problem ;D
>
> Iam trying to archive a Postfix/Dovecot 2.2.10 CentOS7 Multidomain Setup
> with multiple (valid
> StartSSL Certs), but iam only able to run a single Domain Cert server only.
>
> ps: I need a multiple domainssetup for every customer and it is not an
> option for me redirecting any email
> to a single domain server. I really need this setup working.
>
> IMHO: I think it SELinux could interfere with multiple Certs in diffrent
> folders (it is activated in CentOs7 by
> default and is needed by other apps)
What have you done to exclude that SELinux interferes?

Run "ausearch -m avc" to check for AVCs.
> Ok, here is my logfile data:
>
> systemctl start postfix.service [OK]
> systemctl start dovecot.service [OK]
>
> /var/log/messages
> *systemd: Stopping Dovecot IMAP/POP3 email server...
> *systemd: Starting Dovecot IMAP/POP3 email server...
> *systemd: Started Dovecot IMAP/POP3 email server.
>
> /var/log/maillog
> *dovecot: master: Dovecot v2.2.10 starting up for imap, pop3, lmtp (core
> dumps disabled)
>
> ### This works (Thunderbird, Outlook 2013, Opera Mail ect.) ####
>
> local mydomain01.tld {
>
>    protocol imap {
>        ssl_cert >
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem
>        ssl_key >
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem
>    }
>
> }
You are leaving the terrain of your distribution. That's not the 
intended path. /etc/pki/tls/{certs,private}/ is.
> ### this 10-ssl.conf ### --- FAILS (the error occurs after an email
> client accesses IMAP Folders)
> local mydomain01.tld {
>
>    protocol imap {
>        ssl_cert >
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem
>        ssl_key >
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem
>    }
>
> }
>
> local mydomain02.tld {
>
>    protocol imap {
>        ssl_cert >
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem
>        ssl_key >
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem
>    }
>
> }
See above.

Why 2 times the same certificate pair files?

Make sure the permissions (and not only of the files itself) and the 
SELinux context is set properly. You gave zero information about that.
> /var/log/mailog ### Error log ###
> Aug 14 12:50:38 matrix dovecot: imap-login: Fatal: Couldn't parse
> private ssl_key: error:0906D06C:PEM routines:PEM_read_bio:no start line:
> Aug 14 12:50:38 matrix dovecot: master: Error: service(imap-login):
> command startup failed, throttling for 60 secs
The key file contains "-----BEGIN PRIVATE KEY-----" as first line and 
"-----END PRIVATE KEY-----" as last line?
> I really dont know why a single domain is no problem but if i enable
> multiple domains dovecots
> start with any error, even if i set debug verbose leven to extrem high
> but if i access dovecot with
> Thunderbird my server loggile explodes with something like this
Couldn't
> parse private ssl_key: error:0906D06C:PEM but the certs are 100% valid
> and checked over and over again.
>
> Any help is greatly appreciated!
>
> Greetings,
> Dravion
Alexander

Hello Alex

Am 14.08.2015 um 19:57 schrieb Alexander Dalloz:
> What have you done to exclude that SELinux interferes?
>
Just some sysinfo:
CentOS Linux release 7.1.1503 (Core) (i run yum update every day)

sestatus:
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      28
>
> Run "ausearch -m avc" to check for AVCs.
There is no indication SELinux is blocking somewhat

grep "SELinux is preventing" /var/log/messages
grep "denied" /var/log/audit/audit.log
ausearch -m avc shows no deniead messages
>
>> ### This works (Thunderbird, Outlook 2013, Opera Mail ect.) ####
>>
>> local mydomain01.tld {
>>
>>    protocol imap {
>>        ssl_cert >>
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.crt.pem
>>        ssl_key >>
</etc/ssl/domains/mydomain.tld/imap/imap.mydomain02.tld.key.pem
>>    }
>>
>> }
>>
Sorry the above has some typo errors, forget it.

Ok, this works well:

Configfile: /etc/dovecot/conf.d/10-ssl.conf
protocol imap {
ssl_cert = 
</etc/ssl/domains/mydomain01.tld/imap/imap.mydomain01.tld.crt.pem
ssl_key  = 
</etc/ssl/domains/mydomain01.tld/imap/imap.mydomain01.tld.key.pem
}

if i change it to
protocol imap {
ssl_cert = 
</etc/ssl/domains/mydomain02.tld/imap/imap.mydomain02.tld.crt.pem
ssl_key  = 
</etc/ssl/domains/mydomain02.tld/imap/imap.mydomain02.tld.key.pem
}

This works well to (i can connect from a Windows box, with Mozilla 
Thunderbird, Microsoft Outlook 2013
an IMAP Folders are showing, EMail sending and receiving is working and 
the logs are show no error.

#### BUT ####
If i try something like this in /etc/dovecot/conf.d/10-ssl.conf

local imap.mydomain01.tld {
protocol imap {
ssl_cert = 
</etc/ssl/domains/mydomain01.tld/imap/imap.mydomain01.tld.crt.pem
ssl_key  = 
</etc/ssl/domains/mydomain01.tld/imap/imap.mydomain01.tld.key.pem
}
}

local imap.mydomain01.tld {
protocol imap {
ssl_cert = 
</etc/ssl/domains/mydomain02.tld/imap/imap.mydomain02.tld.crt.pem
ssl_key  = 
</etc/ssl/domains/mydomain02.tld/imap/imap.mydomain02.tld.key.pem
}
}

It throws errors like this
"imap-login "parse private ssl_key: error:0906D06C:PEM"
in the logfile /var/maillog

The certs are accepted each in single domainmode but failing in 
multidomain mode.
I have checked if local_name works (SNI) with the fully DNS Domainname 
or just the IP-Address
but this doesnt show any effects.  Multidomainmode of Dovecot is

Notes:
The certs are StartSSL Domain validated free certs, pointing to 
imap.mydomain01.tld and imap.mydomain02.tld
In single Domain mod like explained abow any of the two certificate is 
accepted and Thunderbird and Outlook
accepting the certs as StartSSL without any warning or error message.

ps:
imap.mydomain01.tld.key begins with -----BEGIN RSA PRIVATE KEY----- and 
ends with -----END RSA PRIVATE KEY-----
imap.mydomain02.tld.key begins with -----BEGIN RSA PRIVATE KEY----- and 
ends with -----END RSA PRIVATE KEY-----

ps2:
There was a hint on some website thadt dovecot needs the certs in a 
single *.pem file because the implementation of SNI
and related code "was poorly implemented".

Thanks , Drav