vsftpd not starting when SSL is enabled in config?

Question

linux

There is debian 9, vsftpd is on it, everything works, I want everything transmitted to be encrypted. I read the manuals, everything starts with the line ssl_enable=YES. Ok, I try, write this line to /etc/vsftpd.conf and reload vsftpd.
Checking vsftpd status and...

[email protected]~ $ sudo service vsftpd status
● vsftpd.service - vsftpd FTP server
   Loaded: loaded (/lib/systemd/system/vsftpd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Mon 2018-11-19 22:53:39 MSK; 3s ago
  Process: 1910 ExecStart=/usr/sbin/vsftpd /etc/vsftpd.conf (code=exited, status=2)
  Process: 1907 ExecStartPre=/bin/mkdir -p /var/run/vsftpd/empty (code=exited, status=0/SUCCESS)
 Main PID: 1910 (code=exited, status=2)

Nov 19 22:53:39 deb9 systemd[1]: Starting vsftpd FTP server...
Nov 19 22:53:39 deb9 systemd[1]: Started vsftpd FTP server.
Nov 19 22:53:39 deb9 systemd[1]: vsftpd.service: Main process exited, code=exited, status=2/INVALIDARGUMENT
Nov 19 22:53:39 deb9 systemd[1]: vsftpd.service: Unit entered failed state.
Nov 19 22:53:39 deb9 systemd[1]: vsftpd.service: Failed with result 'exit-code'.

What does he not like about this particular line? If you put its value in NO - everything works.
Whole config:

spoiler

listen=NO
listen_ipv6=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
chroot_local_user=YES
secure_chroot_dir=/var/run/vsftpd/empty
pam_service_name=vsftpd
ssl_enable=YES
allow_anon_ssl=NO
rsa_cert_file=/etc/vsftpd/vsftpd.pem
log_ftp_protocol=YES
pasv_min_port=40000
pasv_max_port=50000

Answer 1

My working config from Ubuntu 16.04

spoiler

listen=YES
anonymous_enable=NO
local_enable=YES
write_enable=YES
local_umask=022
dirmessage_enable=YES
use_localtime=YES
xferlog_enable=YES
connect_from_port_20=YES
ascii_upload_enable=YES
ascii_download_enable=YES
chroot_local_user=YES
pam_service_name=vsftpd
#ssl_enable=YES
ssl_ciphers=HIGH
ssl_tlsv1=YES
ssl_sslv2=NO
ssl_sslv3=NO
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
allow_writeable_chroot=YES
seccomp_sandbox=NO

Answer 2

There is a certificate. What about the key?