lib-ssl-iostream: Indicate that password might be wrong when decrypting key

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index cf33db24fc5ed9744b724aac92e0ea7301518546..a5a9cf3e8d5de0c8c8a7a7c8719c25f379d879bb 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -97,8 +97,12 @@ int openssl_iostream_load_key(const struct ssl_iostream_cert *set,
        pkey = PEM_read_bio_PrivateKey(bio, NULL, pem_password_callback, &ctx);
        if (pkey == NULL && ctx.error == NULL) {
                ctx.error = t_strdup_printf(
-                       "Couldn't parse private SSL key (%s setting): %s",
-                       set_name, openssl_iostream_error());
+                       "Couldn't parse private SSL key (%s setting)%s: %s",
+                       set_name,
+                       ctx.password != NULL ?
+                               " (maybe ssl_key_password is wrong?)" :
+                               "",
+                       openssl_iostream_error());
        }
        BIO_free(bio);