OpenSMTPD: How to debug - OpenBSD's smtpd failed to start
Tags: opensmtpd, mailserver, debug, letsencrypt
Published: 2019-07-20 10:37:58

---
title: OpenSMTPD: How to debug - OpenBSD's smtpd failed to start
published: true
description: This post is about "smtpd -dv -Tlookup". I wrote about how to debug rcctl and find why an error occurs in OpenBSD last year. The "-d" option is still useful to me as well. But it's sometimes insufficient. It was when I used OpenSMTPD. Where there's a will, there's a way. smtpd.8 provides the way!
tags: opensmtpd, mailserver, debug, letsencrypt
canonical_url: https://obsd.solutions/en/blog/2019/07/20/opensmtpd-65-how-to-debug-smtpd-failed-to-start/index.html
---

This post is about:

```console
# smtpd -dv -Tlookup
```

I wrote about how to debug [`rcctl`](https://man.openbsd.org/rcctl) and find why an error occurs in [OpenBSD](https://www.openbsd.org/) last year:

[rcctl: How to debug on OpenBSD 6.4](https://obsd.solutions/en/blog/2018/11/23/rcctl-how-to-debug-on-openbsd-64/index.html)

The [`-d`](https://man.openbsd.org/rc.d.8#d) option is still useful to me as well.
But it's sometimes insufficient.

I have managed my mail server using [OpenSMTPD](https://www.opensmtpd.org/).
On the day when several months had passed since then, `smtpd` daemon in my mail server began to fail:

```console
# rcctl restart smtpd
smtpd(failed)
```

It was when I did some operations which seemed to indifferent from `smtpd`.
I checked [`smtpd.conf`](https://man.openbsd.org/smtpd.conf) but nothing was cleared.
But I thought it was time not to judge a book by its cover.
So I debugged `rcctl`:

```console
# rcctl -d restart smtpd
```

The result was:

```console
doing _rc_parse_conf
doing _rc_quirks
smtpd_flags empty, using default ><
doing _rc_parse_conf /var/run/rc.d/smtpd
doing _rc_quirks
doing _rc_parse_conf
doing _rc_quirks
smtpd_flags empty, using default ><
doing _rc_parse_conf /var/run/rc.d/smtpd
doing _rc_quirks
doing rc_check
doing _rc_parse_conf
doing _rc_quirks
smtpd_flags empty, using default ><
doing _rc_parse_conf /var/run/rc.d/smtpd
doing _rc_quirks
doing rc_check
smtpd
doing rc_start
doing _rc_wait start
doing rc_check
doing _rc_rm_runfile
(failed)
```

Is there any information important?
I couldn't find any.

Well, where there's a will, there's a way.
There is [`smtpd.8`](https://man.openbsd.org/smtpd.8) which provides the way!

```console
# smtpd -dv -Tlookup
```

The result was:

```console
debug: init ssl-tree
info: loading pki information for mail.mana.casa
debug: init ca-tree
debug: init ssl-tree
info: loading pki keys for mail.mana.casa
warn:  /etc/letsencrypt/live/mail.harvest.mana.casa/privkey.pem: insecure permissions: must be at most rwxr----- 
smtpd: load_pki_keys: failed to load key file
```

I found the reason in the last 2 lines:

> permissions: must be at most rwxr----- 
> smtpd: load_pki_keys: failed to load key file

The permissions of the key file were wrong, because they were changed accidentally to insecure `rwxr-xr-x` (755) when I ran `certbot renew`!
[This GitHub issue](https://github.com/OpenSMTPD/OpenSMTPD/issues/785) was helpful.

I changed the permissions:

```console
# chmod go-x <my-key>
# chmod go-r <my-key>
```

Then I got a good output 🙂

```console
# rcctl restart smtpd
smtpd(ok)
```

Thank you for your reading.
Happy computing.