raised for inbound connections, if the main configuration event_action
option is defined.
+TL/06 In test suite, disable OCSP for old versions of openssl which contained
+ early OCSP support, but no stapling (appears to be less than 1.0.0).
+
+ JH/09 When compiled with OpenSSL and EXPERIMENTAL_CERTNAMES, the checks on
+ server certificate names available under the smtp transport option
+ "tls_verify_cert_hostname" now do not permit multi-component wildcard
+ matches.
+
Exim version 4.84
-----------------
support to date has not made these checks.
If built with EXPERIMENTAL_CERTNAMES defined, code is
- included to do so, and a new smtp transport option
- "tls_verify_cert_hostname" supported which takes a list of
- names for which the checks must be made. The host must
- also be in "tls_verify_hosts".
+ included to do so for server certificates, and a new smtp transport option
-"tls_verify_cert_hostname" supported which takes a list of
-names for which the checks must be made. The host must
-also be in "tls_verify_hosts".
++"tls_verify_cert_hostnames" supported which takes a list of
++names for which the additional checks must be made.
++The option currently defaults to empty, but this may change in
++the future. "*" is probably a suitable value.
++Whether certificate verification is done at all, and the result of
++it failing, is stll under the control of "tls_verify_hosts" nad
++"tls_try_verify_hosts".
Both Subject and Subject-Alternate-Name certificate fields
are supported, as are wildcard certificates (limited to