The privkey.pem contains an EC PARAMETERS pem object followed by the EC PRIVATE KEY pem object. The EC PARAMETERS object is unnecessary because it just contains the name of the standard curve which is already encoded in the key itself. Most software ignores the parameters object but some doesn't and breaks.

For example, in postfix before version 3.4 the EC key file is set in the "smtpd_tls_eckey_file" variable and it is read using SSL_CTX_use_PrivateKey_file() which skips over and discards the EC PARAMETERS object. But postfix 3.4 added a new "smtpd_tls_chain_files" variable which sets all the various key and cert files in one variable, and then postfix reads the files using different code that doesn't tolerate EC PARAMETERS and throws an error:

warning: error loading privkey.pem: unexpected PEM type: EC PARAMETERS warning: error loading private keys and certificates from: privkey.pem,fullchain.pem: disabling TLS support

Adding a "-noout" switch to the "ecparam -genkey" command tells it not to output the unnecessary EC PARAMETERS object. The resulting key file works with software that would have tolerated it and with the new postfix which does not.

Here's a patch. ec_noout_patch.txt

For background, here are some links that led me to this solution as I was digging down.

An OpenSSL wiki suggesting using -noout to get rid of the EC parameters: trent.utfs.org wiki

A stack exchange post referenced above explaining what's going on: security.stackexchange.com