Sendmail TLS

[Nick Wilson]

I have tried to set up TLS for Sendmail, as described in chapter 14.9 of 
the handbook.  Having created the certificates in /etc/certs and 
modified the sendmail .mc file, I have the following problem:

With the myca.key file permissions set to readable by root only

-rwx------  1 root  wheel   736 Dec 29 17:11 myca.key

sendmail gives the message

Dec 29 18:57:01 jericho sm-mta[901]: STARTTLS=server, error: 
SSL_CTX_use_PrivateKey_file(/etc/certs/myca.key) failed

if I set the permissions to add group readable, I get

Dec 29 17:27:02 jericho sm-mta[659]: STARTTLS=server: file 
/etc/certs/myca.key unsafe: Group readable file

What owner, group and permissions should I set for myca.key?

Many thanks,

Nick