Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
This is supposed to be the title, but the dad-blamed thing says "can't have more than one emoji in the titile. THERE ARE NO STINKING EMOJIs IN THE TITLE. I don't use emojs, my IQ is higher than room temperature in Alaska in February.
error:0906D06C:PEM routines:PEM_read_bio:no start line
DISCLAIMER--I was asked last night to help a friend who's got a antique (SuSE 11.4) mail server. Our short term plan is to replace the server with something more modern, but his domestic tranquility and stress levels will be greatly enhanced if we can get SSL working on the IMAP server so his peeps can check their email without pain. So yeah, we're out of date and we know it and it'll be fixed shortly. In the mean time...
My domain is: mail.rcousins.com
I ran this command:
grep start /var/log/mail
It produced this output:
Jul 20 21:13:31 colo7 imapd-ssl: couriertls: /etc/ssl/postfix/mail.rcousins.com.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line
But before that I ran:
./getssl mail.rcousins.com
and it produced:
-rw-r--r-- 1 root root 2.5K Jul 20 20:50 mail.rcousins.com.crt
-rw-r--r-- 1 root root 1.7K Jul 20 20:50 ca_cert.crt
in the /etc/ssl/postfix directory and:
x:~/.getssl/mail.rcousins.com/archive/2018_07_20_20_50 # ls -lthr
total 24K
-rw------- 1 root root 2.5K Jul 20 20:50 mail.rcousins.com.crt
-rw------- 1 root root 1.6K Jul 20 20:50 mail.rcousins.com.csr
-rw------- 1 root root 3.2K Jul 20 20:50 mail.rcousins.com.key
-rw------- 1 root root 1.7K Jul 20 20:50 chain.crt
-rw------- 1 root root 4.1K Jul 20 20:50 fullchain.crt
in, well, you see the path.
My -web-server- IMAP server is (include version):
Courier-imapd-ssl, version "ancient"...err...4.8
The operating system my IMAP server runs on is (include version):
SuSE 11.4
My hosting provider, if applicable, is: NA
I can login to a root shell on my machine (yes or no, or I don't know):
Yes.
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
Control panel? I've heard of those things...Is that like a GUI all those kids are using today? Bah. new fangled nonsense if you ask me. GET OFF MY LAWN.
As indicated above, I'm using the getssl script I found on github because fighting my way through the python dependencies on a 8 year old box is not something I really wanted to do on a friday night (10:30 and I'm still NOT DRINKING WHAT IS WRONG HERE!).
I used the CA="https://acme-staging.api.letsencrypt.org" for testing, then switched to:
CA="https://acme-v01.api.letsencrypt.org"
Here's the top level getssl.conf:
grep -v "^#" ../getssl.cfg | sed '/^$/d'
CA="https://acme-v01.api.letsencrypt.org"
ACCOUNT_EMAIL="petro@(censored)"
ACCOUNT_KEY_LENGTH=4096
ACCOUNT_KEY="/root/.getssl/account.key"
PRIVATE_KEY_ALG="rsa"
REUSE_PRIVATE_KEY="true"
RENEW_ALLOW="30"
SERVER_TYPE="https"
CHECK_REMOTE="true"
and the getssl.conf in the mail.rcousins.com directory is:
grep -v "^#" getssl.cfg | sed '/^$/d'
SANS=""
ACL=('/srv/www/htdocs/.well-known/acme-challenge')
USE_SINGLE_ACL="true"
DOMAIN_CERT_LOCATION="/etc/ssl/postfix/mail.rcousins.com.crt"
DOMAIN_KEY_LOCATION="/etc/ssl/postfix/mail.rcousins.com.key"
CA_CERT_LOCATION="/etc/ssl/postfix/ca_cert.crt"
RELOAD_CMD="service courier-imap-ssl restart"
SERVER_TYPE="imaps"
CHECK_REMOTE="true"
The certificates appear to have generated fine, "openssl x509 -in mail.rcousins.com.crt -text" and "openssl x509 -in ca_cert.crt -text" produce stuff that looks right to my eye (which is NOT a practiced eye).
However when I point courier IMAPD at them:
TLS_CERTFILE=/etc/ssl/postfix/mail.rcousins.com.crt
TLS_TRUSTCERTS=/etc/ssl/postfix/ca_cert.crt
and then restart the daemon I get:
Jul 20 21:13:31 colo7 imapd-ssl: couriertls: /etc/ssl/postfix/mail.rcousins.com.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line
in /var/log/mail
and no one can connect to the imapd server.
What did I screw up?
Edited to add: I did do a DuckDuckGo search for the error message, but was long on actions specific to the generator used, and short on generic "here's where you messed up". Please tell me where I messed up so I can learn from this.
(written 
And also the error message is quite unhelpful because instead of giving the low-level nondescript OpenSSL message about a missing PEM object, Courier could just say “I expected to load a private key from this file, but couldn’t”!