Enable and Configure STARTTLS in Exim

Learn how to enable STARTTLS in Exim, manage SSL certificates, and enforce TLS encryption for specific hosts.

Last updated: July 2026

In short: Transport Layer Security (TLS) via STARTTLS protects email traffic in transit. In Exim, this is controlled by the global tls_advertise_hosts option. To successfully enable TLS, you must configure a certificate and private key file that are readable by the Exim system user.

When running your own mail server with Exim, securing SMTP connections with TLS is essential. Security scanners like Kuveris often report issues such as STARTTLS not being offered. To resolve these findings, you must enable and correctly configure TLS support in Exim.

Prerequisites: Setting Certificates and Keys

To use TLS in Exim, you must configure the paths to your SSL/TLS certificate and private key.

The official Exim documentation states: To make TLS work you need to set, in the server, tls_certificate = /some/file/name tls_privatekey = /some/file/name

These certificate and key files must meet specific security requirements: These files need to be PEM format and readable by the Exim user, and must always be given as full path names. The key must not be password-protected.

This means:

The files must be in PEM format.
You must provide absolute (full) paths.
The private key must not be password-protected (no passphrase), otherwise Exim cannot load it automatically upon startup.
The files must be readable by the Exim system user.

Add these configurations to your Exim configuration file (e.g., /etc/exim/exim.conf):

tls_certificate = /etc/ssl/certs/mail.example.com.crt
tls_privatekey = /etc/ssl/private/mail.example.com.key

Advertising STARTTLS with tls_advertise_hosts

Once the certificates are configured, you use the tls_advertise_hosts option to control which remote clients are offered the STARTTLS command.

Exim's specification defines the following behavior: To enable TLS operations on a server, the tls_advertise_hosts option must be set to match some hosts. The default is * which matches all hosts.

And further explains: it advertises the availability of the STARTTLS command to client hosts that match tls_advertise_hosts, but not to any others. The default value of this option is *, which means that STARTTLS is always advertised. Set it to blank to never advertise

To advertise STARTTLS to all connecting clients, ensure that the option is set to * (which is the default):

tls_advertise_hosts = *

If you wish to completely disable STARTTLS advertisements, set it to an empty value:

tls_advertise_hosts =

Enabling TLS-on-Connect (Port 465)

Exim also supports direct TLS connections (TLS-on-connect) which are typically used for client submission on port 465.

According to the specification: Exim supports TLS-on-connect by means of the tls_on_connect_ports global option. Its value must be a list of port numbers; the most common use is expected to be: tls_on_connect_ports = 465

To configure this, add port 465 to the tls_on_connect_ports list in the global configuration section:

tls_on_connect_ports = 465

Outbound Mail Delivery and TLS (smtp Transport)

When sending emails to external servers, Exim automatically attempts to use TLS if it is supported by the receiving mail server.

The documentation states: If Exim is built with TLS support, and TLS is advertised by a server, the smtp transport always tries to start a TLS session.

No additional parameters are needed in the standard smtp transport for opportunistic TLS.

However, if you want to make TLS encryption mandatory for specific target hosts or domains, you can use the hosts_require_tls option in your transport configuration:

you can set hosts_require_tls to a list of hosts for which encryption is mandatory. For those hosts, delivery is always deferred if an encrypted connection cannot be set up.

Example configuration inside your SMTP transport:

hosts_require_tls = secure.example.com : *.secure-mx.net

Verifying Your Setup