Q:

How to set up a nested if for an exim tls certificate?

At first my config for exim tls certificate looked like this:
tls_certificate = ${if exists{/etc/exim4/ssl/${tls_sni}.crt}{/etc/exim4/ssl/${tls_sni}.crt}{/etc/exim4/ssl/exim.crt}}
tls_privatekey = ${if exists{/etc/exim4/ssl/${tls_sni}.key}{/etc/exim4/ssl/${tls_sni}.key}{/etc/exim4/ssl/exim.key}}

And it works.
I'm trying to make a nested condition:
tls_certificate = ${if exists{/etc/exim4/ipssl/${received_ip_address}.crt}{/etc/exim4/ipssl/${received_ip_address}.crt}{${if exists{/etc/exim4/ssl/${tls_sni}.crt}{/etc/exim4/ssl/${tls_sni}.crt}{/etc/exim4/ssl/exim.crt}}}
tls_privatekey = ${if exists{/etc/exim4/ipssl/${received_ip_address}.key}{/etc/exim4/ipssl/${received_ip_address}.key}{${if exists{/etc/exim4/ssl/${tls_sni}.key}{/etc/exim4/ssl/${tls_sni}.key}{/etc/exim4/ssl/exim.key}}}

This config passes the syntactic test (exim -bV), but the server closes tcp-connection immediately after any client connects with the message in paniclog:
2017-08-01 07:14:56 expansion of tls_certificate failed: missing or misplaced { or }

I thought that I can not use nested if conditions, but then I found this in the default exim config:
REMOTE_SMTP_RETURN_PATH=${if match_domain{$sender_address_domain}{+local_domains}{${sender_address_local_part}@DCreadhost}{${if match_domain{$sender_address_domain}{ETC_MAILNAME}{${sender_address_local_part}@DCreadhost}fail}}}

Why are nested conditions not working in my case?
Is there a way to make similar conditions for tls certs?

A:

I believe you're missing one closing bracket. Tip: try writing the condition like this when testing it for easier debugging when issues like this arise:
${
  if exists{/etc/exim4/ipssl/${received_ip_address}.crt} {
    /etc/exim4/ipssl/${received_ip_address}.crt
  } {
    ${
      if exists{/etc/exim4/ssl/${tls_sni}.crt} {
        /etc/exim4/ssl/${tls_sni}.crt
      } {
        /etc/exim4/ssl/exim.crt
      }
    }
  }
} <--

