dovecot - Apr 2020 - Dovecot Failed to initialize SSL server context

I'm trying to configure TLS for Dovecot 2.3 but after setting all things up
I'm not able to start  Dovecot:

    Apr 16 20:56:02 master: Info: Dovecot v2.3.9.3 (9f41b88fa) starting up for
imap, pop3, lmtp (core dumps disabled)
    Apr 16 20:56:25 auth: Debug: Loading modules from directory:
/usr/lib/dovecot/auth
    Apr 16 20:56:25 auth: Debug: Module loaded:
/usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so
    Apr 16 20:56:25 auth: Debug: Read auth token secret from
/usr/var/run/dovecot/auth-token-secret.dat
    Apr 16 20:56:25 auth: Debug: auth client connected (pid=30750)
    Apr 16 20:56:25 imap-login: Error: Failed to initialize SSL server context:
Can't load SSL private key: Key is for a different cert than ssl_cert:
user=<>, rip=::1, lip=::1, secured,
session=<JKh/qm6j/rMAAAAAAAAAAAAAAAAAAAAB>
    Apr 16 20:56:25 imap-login: Info: Disconnected: TLS initialization failed.
(no auth attempts in 0 secs): user=<>, rip=::1, lip=::1, secured,
session=<JKh/qm6j/rMAAAAAAAAAAAAAAAAAAAAB>
    Apr 16 20:57:47 master: Fatal: Dovecot is already running with PID 30727
(read from /usr/var/run/dovecot/master.pid)
    Apr 16 20:57:47 master: Warning: Killed with signal 15 (by pid=30823 uid=0
code=kill)

I have created a brand new key pair, csr and the cert but still it complains to
start.

Any thoughts on that?

Thanks,
Adam
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20200416/24ba2954/attachment-0001.html>

Adam Raszkiewicz <araszkiewicz at medallies.com> writes:
> I'm trying to configure TLS for Dovecot 2.3 but after setting all
things up I'm
> not able to start  Dovecot:
>
>     Apr 16 20:56:25 imap-login: Error: Failed to initialize SSL server
context:
> Can't load SSL private key: Key is for a different cert than ssl_cert:
user=<>,
> rip=::1, lip=::1, secured, session=<JKh/qm6j/rMAAAAAAAAAAAAAAAAAAAAB>
This is your problem -- you have a mismatch between key and certificate.
Check again using doveconf your certificate and key file ocations they
correspond to what you expect.
> I have created a brand new key pair, csr and the cert but still it
complains to
> start.
> 
> Any thoughts on that?
You normally don't use the CSR, but you can check all the files to make
sure the modulus matches and they belong to each other

 	openssl x509 -in file.crt -noout -modulus
 	openssl rsa -in file.key -noout -modulus
 	openssl req -in file.csr -noout -modulus

Joseph Tam <jtam.home at gmail.com>