Dovecot Fails to Start With an Error in 95-iworx-sni-hosts.conf
===============================================================

.. contents::

How the Issue Manifests
-----------------------

Dovecot is stopped and cannot be restarted. 

Checking the status of the Dovecot service shows an error referencing ``/etc/dovecot/conf.d/95-iworx-sni-hosts.conf``, like
the following:

.. code-block::

   [root@server ~]# systemctl status dovecot
   × dovecot.service - Dovecot IMAP/POP3 email server
   Loaded: loaded (/usr/lib/systemd/system/dovecot.service; enabled; preset: disabled)
   Active: failed (Result: exit-code) since Thu 2026-07-02 15:16:49 UTC; 12min ago
   Docs: man:dovecot(1)
   https://doc.dovecot.org/
   Main PID: 160453 (code=exited, status=89)
   CPU: 73ms

   Jul 02 15:16:49 server systemd[1]: Starting Dovecot IMAP/POP3 email server...
   Jul 02 15:16:49 server dovecot[160453]: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/95-iworx-sni-hosts.conf line 23: ssl_cert: Can't >
   Jul 02 15:16:49 server systemd[1]: dovecot.service: Main process exited, code=exited, status=89/n/a
   Jul 02 15:16:49 server systemd[1]: dovecot.service: Failed with result 'exit-code'.
   Jul 02 15:16:49 server systemd[1]: Failed to start Dovecot IMAP/POP3 email server.

Common Cause of the Issue
-------------------------

``/etc/dovecot/conf.d/95-iworx-sni-hosts.conf`` is missing SSL information for some domains on the server. 

Troubleshooting
---------------

Check the SNI Hosts File for Incomplete Entries
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

#. Log in to the server at the CLI as root, either via SSH or from the terminal
#. With a text editor, open ``/etc/dovecot/conf.d/95-iworx-sni-hosts.conf``. The following example uses the Vim text editor:

   .. code-block::

      vim /etc/dovecot/conf.d/95-iworx-sni-hosts.conf

#. Enable line numbers in the text editor. The following example is sets line numbers in Vim: 

   .. code-block::

      :set nu 

#. Find the line number stated in the status error.  In the following example, the domain block starting on line 17 is correct. 
   The domain blocks starting on lines 22 and 27 are incorrect, and missing private key information: 

   .. code-block::

      17 local_name ftp.domain.com {
      18 ssl_cert = </home/domainco/var/domain.com/ssl/domain.com.chain.pem
      19 ssl_key = </home/domainco/var/domain.com/ssl/domain.com.priv.key
      20 }
      21
      22 local_name example.com {
      23 ssl_cert = </home/examplec/var/example.com/ssl/example.com.chain.pem
      24 ssl_key = <
      25 }
      26
      27 local_name sub.example.com {
      28 ssl_cert = </home/examplec/var/example.com/ssl/example.com.chain.pem
      29 ssl_key = <
      30 }

#. Note the domains with incomplete entries, and exit the text editor

How to Resolve
--------------

#. Log in to the server at the CLI as root, either via SSH or from the terminal
#. Run the following. This will check the SSL status for the domains on the server, and rewrite the corresponding information 
   in ``/etc/dovecot/conf.d/95-iworx-sni-hosts.conf``:

   .. code-block::

      nodeworx -u -n -c MailDovecot -a syncDovecotSniHosts

#. Start Dovecot:

   .. code-block::

      systemctl start dovecot

#. Confirm that the service is running:

   .. code-block::

      systemctl status dovecot

Other Considerations
--------------------

- If the sync completes but Dovecot still shows same error upon attempted restart, the most common cause is that the SSL 
  certificate for the affected domain is corrupt or partially missing on disk. Reinstalling the certificate for that domain, 
  and then re-running the sync command generally resolves the issue. Information on how to manage domain-level SSL certificates
  can be found :doc:`here </siteworx/domains_and_websites/site_management/setup-ssl-certificate>`.