Unable to install mail certificate in Plesk: Failed at step NAMESPACE spawning /usr/bin/doveadm: No such file or directory

Symptoms

• Issuing Lets Encrypt certificate for mail service from Domains > example.com > SSL/TLS Certificate fails with the following error in Plesk:

  Could not install mail certificate: [2025-08-08 12:11:45.587] 1272205:6895cd618ee5c ERR [util_exec] proc_close() failed ['/opt/psa/admin/bin/mailmng-imap' '--install-certificate' '--names=example.com,mail.example.com' '--certfile=/opt/psa/var/certificates/scfhlm9efka68Au4xJq'] with exit code [1] mailmng-imap failed: INFO: [Fri Aug 8 12:11:44 SAST 2025]: Service: dovecot, Action: reload-or-restart Trying to reload-or-restart service dovecot...

• The following error show up in dovecot journal while trying to reload the service:

  systemd[1]: Reloading Dovecot IMAP/POP3 email server.
  systemd[204265]: Failed to create destination mount point node '/run/systemd/unit-root/tmp': No such file or directory
  systemd[204265]: Failed to mount /tmp/systemd-private-4a3bc8a808414b24949803b319598194-dovecot.service-ithXuh/tmp to /run/systemd/unit-root/tmp: No such file or directory
  systemd[204265]: dovecot.service: Failed to set up mount namespacing: /run/systemd/unit-root/tmp: No such file or directory
  systemd[204265]: dovecot.service: Failed at step NAMESPACE spawning /usr/bin/doveadm: No such file or directory
  systemd[1]: dovecot.service: Control process exited, code=exited, status=226/NAMESPACE
  systemd[1]: Reload failed for Dovecot IMAP/POP3 email server.

• The file /usr/bin/doveadm exists on the server and has correct permissions:

  # stat /usr/bin/doveadm
  File: /usr/bin/doveadm
  Size: 693672 Blocks: 1360 IO Block: 4096 regular file
  Device: 8,2 Inode: 56887632 Links: 1
  Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)

• The following error show up in Plesk while trying to change mail certificate from Tools & Settings > SSL/TLS Certificates

  Error: sslmng failed: job for dovecot.service failed. See "systemctl status dovecot.service" and "journalctl -xe" for details. Job for dovecot.service failed. See "systemctl status dovecot.service" and "journalctl -xe" for detail. ERROR: Failed to reload or restart 'dovecot' service during rollback: Command '['/opt/psa/admin/sbin/pleskrc', 'dovecot', 'reload']' returned non-zero exit status 1. ERROR: Command '['/opt/psa/admin/sbin/pleskrc', 'dovecot', 'reload']' returned non-zero exit status 1.

• AppArmor is running on the server

  # systemctl status apparmor.service
  ● apparmor.service - Load AppArmor profiles
  Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; preset: enabled)
  Active: active (exited) since Thu 2025-08-07 11:42:00 SAST; 24h ago
  Docs: man:apparmor(7)

Cause

AppArmor service is preventing dovecot to reload correctly.

Resolution

1. Connect to the server via SSH

2. Restart the dovecot service:

   # systemctl restart dovecot.service

3. Reload AppArmor service

   # systemctl reload apparmor.service

4. Reissue mail certificate