Make smtp transport try server cert verify by default

This is an exim client checking a server certificate.

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 7dfc4d623c11157d551fe01f3631fd49675291e7..b2b703b451ba60f9891a07d92700a4fb200eb778 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -23433,7 +23433,7 @@ unknown state), opens a new one to the same host, and then tries the delivery
 in clear.
 
 
-.option tls_try_verify_hosts smtp "host list&!!" unset
+.option tls_try_verify_hosts smtp "host list&!!" *
 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 This option gives a list of hosts for which, on encrypted connections,
@@ -23489,6 +23489,7 @@ expansion of this option. See chapter &<<CHAPTLS>>& for details of TLS.
 
 For back-compatability,
 if neither tls_verify_hosts nor tls_try_verify_hosts are set
+(a single-colon empty list counts as being set)
 and certificate verification fails the TLS connection is closed.
 
 

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 76d18a87c2af2589915716948faa5ed97a135fb5..ab55078086a53a315e0bb52fb3ab1065cee610b4 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -21,6 +21,9 @@ JH/05 The value of the tls_verify_certificates smtp transport and main options
       default to the word "system" to access the system default CA bundle.
       For GnuTLS, only version 3.0.20 or later.
 
+JH/06 Verification of the server certificate for a TLS connection is now tried
+      (but not required) by default.
+
 
 Exim version 4.85
 -----------------

diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
index 42d04224a4646ba1908d5c3f6987b269de2bc131..8b28d55664d779d1e6e01db346779511866298f5 100644 (file)
--- a/src/src/tls-gnu.c
+++ b/src/src/tls-gnu.c
@@ -853,14 +853,14 @@ error message is provided. However, if we just refrain from setting anything up
 in that case, certificate verification fails, which seems to be the correct
 behaviour. */
 
-if (  state->tls_verify_certificates && *state->tls_verify_certificates
-#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
-   && Ustrcmp(state->exp_tls_verify_certificates, "system") != 0
-#endif
-   )
+if (state->tls_verify_certificates && *state->tls_verify_certificates)
   {
   if (!expand_check_tlsvar(tls_verify_certificates))
     return DEFER;
+#ifndef SUPPORT_SYSDEFAULT_CABUNDLE
+  if (Ustrcmp(state->exp_tls_verify_certificates, "system") == 0)
+    state->exp_tls_verify_certificates = NULL;
+#endif
   if (state->tls_crl && *state->tls_crl)
     if (!expand_check_tlsvar(tls_crl))
       return DEFER;
@@ -1860,7 +1860,7 @@ the specified host patterns if one of them is defined */
 
 if (  (  state->exp_tls_verify_certificates
       && !ob->tls_verify_hosts
-      && !ob->tls_try_verify_hosts
+      && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
       )
     || verify_check_given_host(&ob->tls_verify_hosts, host) == OK
    )

diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index bb17821e474d37fc39c31ebd1fee204041b255c8..ce6b47832843b06b17c4b804f11029b3f954be8e 100644 (file)
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -1686,7 +1686,9 @@ int rc;
    set but both tls_verify_hosts and tls_try_verify_hosts is not set. Check only
    the specified host patterns if one of them is defined */
 
-if (  (!ob->tls_verify_hosts && !ob->tls_try_verify_hosts)
+if (  (  !ob->tls_verify_hosts
+      && (!ob->tls_try_verify_hosts || !*ob->tls_try_verify_hosts)
+      )
    || (verify_check_given_host(&ob->tls_verify_hosts, host) == OK)
    )
   client_verify_optional = FALSE;

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index a455ba5532afcf1298ac3df6be3bd9741de12d5f..181081b60eff7fff285d2afa57ca2ec5d44d28fb 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -260,7 +260,7 @@ smtp_transport_options_block smtp_transport_option_defaults = {
                        /* tls_dh_min_bits */
   TRUE,                /* tls_tempfail_tryclear */
   NULL,                /* tls_verify_hosts */
-  NULL,                /* tls_try_verify_hosts */
+  US"*",               /* tls_try_verify_hosts */
   US"*"                /* tls_verify_cert_hostnames */
 #endif
 #ifndef DISABLE_DKIM

diff --git a/test/confs/2000 b/test/confs/2000
index 06e5a153cab4558f1a2b0ea2d98e244f05d217ca..bc4fff2a4cd6d77bb2eb251b21f3166099bab783 100644 (file)
--- a/test/confs/2000
+++ b/test/confs/2000
@@ -56,6 +56,7 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2
+  tls_try_verify_hosts =
 
 
 # ----- Retry -----

diff --git a/test/confs/2001 b/test/confs/2001
index 741796b678cd6c3ac3e1987d8270447737607178..7e49aeda20085264b5415a1fad67c31f45108e46 100644 (file)
--- a/test/confs/2001
+++ b/test/confs/2001
@@ -56,6 +56,7 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2
+  tls_try_verify_hosts =
 
 
 # ----- Retry -----

diff --git a/test/confs/2012 b/test/confs/2012
index 6bc5487fffbc9edc4ef5790a8640bc933ff5b30a..023a594a8a456fd3fc04b132c6c741ad160d9289 100644 (file)
--- a/test/confs/2012
+++ b/test/confs/2012
@@ -104,6 +104,7 @@ send_to_server_failcert:
   tls_privatekey = CERT2
 
   tls_verify_certificates = CA2
+  tls_try_verify_hosts =
   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert at HOSTIPV4 so fail the crypt, then retry on 127.1; ok
@@ -118,6 +119,7 @@ send_to_server_retry:
 
   tls_verify_certificates = \
     ${if eq{$host_address}{127.0.0.1}{CA1}{CA2}}
+  tls_try_verify_hosts =
   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert but continue unverified though crypted

diff --git a/test/confs/2100 b/test/confs/2100
index 791c6bd436699dadcc02ba5e4f1c99d11c3abd73..c6a7e698e4a4812c335dcc88b63dd02ca588d28d 100644 (file)
--- a/test/confs/2100
+++ b/test/confs/2100
@@ -54,6 +54,7 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2
+  tls_try_verify_hosts = :
 
 
 # ----- Retry -----

diff --git a/test/confs/2101 b/test/confs/2101
index 73e0bdd7dc4732c58281c501611fdabc4e536db1..99fad1a4857442f75db1cfd98925eae5e7a3afb8 100644 (file)
--- a/test/confs/2101
+++ b/test/confs/2101
@@ -56,6 +56,7 @@ send_to_server:
   tls_certificate = DIR/aux-fixed/cert2
   tls_privatekey = DIR/aux-fixed/cert2
   tls_verify_certificates = DIR/aux-fixed/cert2
+  tls_try_verify_hosts =
 
 
 # ----- Retry -----

diff --git a/test/confs/2112 b/test/confs/2112
index 2c81e0cf3a2240250379031b171e5edd39820add..d21fee0648f04b7c9241e37192cce98942a0549e 100644 (file)
--- a/test/confs/2112
+++ b/test/confs/2112
@@ -104,6 +104,7 @@ send_to_server_failcert:
   tls_privatekey = CERT2
 
   tls_verify_certificates = CA2
+  tls_try_verify_hosts =
   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert at HOSTIPV4 so fail the crypt, then retry on 127.1; ok
@@ -118,6 +119,7 @@ send_to_server_retry:
 
   tls_verify_certificates = \
     ${if eq{$host_address}{127.0.0.1}{CA1}{CA2}}
+  tls_try_verify_hosts =
   tls_verify_cert_hostnames =
 
 # this will fail to verify the cert but continue unverified though crypted

diff --git a/test/confs/2113 b/test/confs/2113
index bff43ff574fb9ba3d9dd8bb95acf1c459c7b7ee3..d5be248615d607c25bb70e499ddb2af7a8c9993a 100644 (file)
--- a/test/confs/2113
+++ b/test/confs/2113
@@ -61,5 +61,6 @@ send_to_server:
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
+  tls_try_verify_hosts = :
 
 # End

diff --git a/test/confs/2117 b/test/confs/2117
index 16cc0c39e75652850e70fb6cd2bc4765d67b18a3..ab809d0817333dc1e31c83dde83aac99bad708d1 100644 (file)
--- a/test/confs/2117
+++ b/test/confs/2117
@@ -60,6 +60,7 @@ send_to_server:
   hosts = 127.0.0.1
   hosts_nopass_tls = *
   port = PORT_D
+  tls_try_verify_hosts = :
 
 
 # ----- Retry -----

diff --git a/test/confs/2125 b/test/confs/2125
index 70736be88ec74991a68b82d3086d7374ffdcf26a..767bb1c4fc724d2f2ec676ff5617ca79d252f686 100644 (file)
--- a/test/confs/2125
+++ b/test/confs/2125
@@ -53,6 +53,7 @@ send_to_server:
   hosts_require_tls = HOSTIPV4
   tls_require_ciphers = DES-CBC3-SHA
   port = PORT_D
+  tls_try_verify_hosts = :
 
 
 # ----- Retry -----

diff --git a/test/confs/2126 b/test/confs/2126
index e2b79016856d98e5888e33fca4aaaeee447d8062..704346e5655105b8c88da59837d883082ee53caa 100644 (file)
--- a/test/confs/2126
+++ b/test/confs/2126
@@ -57,6 +57,7 @@ t1:
   hosts = 127.0.0.1 : HOSTIPV4
   port = PORT_D
   allow_localhost
+  tls_try_verify_hosts = :
 
 t2:
   driver = appendfile

diff --git a/test/confs/2127 b/test/confs/2127
index 3639c5bbf38580e9f4286a54c89721abb3de5bf9..862ad710d05e94815370918a7fddb760c8b01156 100644 (file)
--- a/test/confs/2127
+++ b/test/confs/2127
@@ -56,5 +56,6 @@ send_to_server:
   allow_localhost
   hosts = ${if eq{$local_part}{userx}{127.0.0.1}{HOSTIPV4}}
   port = PORT_D
+  tls_try_verify_hosts = :
 
 # End

diff --git a/test/confs/2130 b/test/confs/2130
index 4143fc8caaae6008440dc59588d452de56c4d805..9f6de76b474732bd8020d11c0232231a25cb49a2 100644 (file)
--- a/test/confs/2130
+++ b/test/confs/2130
@@ -60,12 +60,14 @@ send_to_server1:
   hosts = HOSTIPV4
   port = PORT_D
   tls_sni = fred
+  tls_try_verify_hosts = :
 
 send_to_server2:
   driver = smtp
   allow_localhost
   hosts = HOSTIPV4
   port = PORT_D
+  tls_try_verify_hosts = :
 
 
 # ----- Retry -----

diff --git a/test/confs/2131 b/test/confs/2131
index 8566c24baf443761bca90fb0a322e7da0d244ff6..53c06f1f735413aa21b12f17b816c7c322b2fcf3 100644 (file)
--- a/test/confs/2131
+++ b/test/confs/2131
@@ -73,6 +73,7 @@ send_to_server1:
   port = PORT_D
   tls_sni = fred
   hosts_require_tls = *
+  tls_try_verify_hosts = :
 
 send_to_server2:
   driver = smtp
@@ -81,6 +82,7 @@ send_to_server2:
   port = PORT_D
   tls_sni = bill
   hosts_require_tls = *
+  tls_try_verify_hosts = :
 
 
 # ----- Retry -----

diff --git a/test/confs/2149 b/test/confs/2149
index 1684f11c6af54adeb135dc71068b9b7e9252286a..cf67f8cbcb66308bf00e9bc7c2f445adf1782907 100644 (file)
--- a/test/confs/2149
+++ b/test/confs/2149
@@ -55,5 +55,6 @@ send_to_server:
   allow_localhost
   hosts = 127.0.0.1
   port = PORT_D
+  tls_try_verify_hosts = :
 
 # End

diff --git a/test/confs/3461 b/test/confs/3461
index 48fe4da3ef557640a165bcda537f929794b30674..93ab8d8d82dcf5463dce4b52f563a91d81ef8634 100644 (file)
--- a/test/confs/3461
+++ b/test/confs/3461
@@ -75,5 +75,6 @@ send_to_server:
   hosts = 127.0.0.1
   hosts_try_auth = *
   port = PORT_D
+  tls_try_verify_hosts = :
 
 # End

diff --git a/test/confs/3462 b/test/confs/3462
index ec155bfddbb15eff4c860b24e4cbdae663aee23e..3907aecef51265ab97138b7dc358eda056b37d68 100644 (file)
--- a/test/confs/3462
+++ b/test/confs/3462
@@ -74,6 +74,7 @@ send_to_server:
   hosts = 127.0.0.1
   hosts_try_auth = *
   port = PORT_D
+  tls_try_verify_hosts = :
 
 
 # ----- Retry -----

diff --git a/test/confs/3465 b/test/confs/3465
index 83592a678c3a6ebd663fe581fa3c69ea98dbba68..2f2061be0cb687a1d7c11dcba8f525feed0c74de 100644 (file)
--- a/test/confs/3465
+++ b/test/confs/3465
@@ -67,6 +67,7 @@ t1:
   hosts = 127.0.0.1
   port = PORT_D
   hosts_avoid_tls = HOSTS_AVOID_TLS
+  tls_try_verify_hosts = :
   hosts_require_auth = *
   allow_localhost
 

diff --git a/test/confs/5410 b/test/confs/5410
index 576967cacb977d6ea124086542ee17fca9f1cdf8..bea8e10bac2ec38e90b8272566f54efa31c752a6 100644 (file)
--- a/test/confs/5410
+++ b/test/confs/5410
@@ -54,6 +54,7 @@ smtp:
   port = PORT_D
   hosts_avoid_tls =        ${if eq {$address_data}{usery}{*}{:}}
   hosts_verify_avoid_tls = ${if eq {$address_data}{userz}{*}{:}}
+  tls_try_verify_hosts = :
 
 
 # End

diff --git a/test/confs/5651 b/test/confs/5651
index 19f16d03dd4f5e531e13096a78b7ca9f6cb7ced7..f09df575b02decd9ad12ccaa84eb5004e723a112 100644 (file)
--- a/test/confs/5651
+++ b/test/confs/5651
@@ -116,6 +116,7 @@ send_to_server3:
   helo_data = helo.data.changed
   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
+  tls_try_verify_hosts =
   tls_verify_cert_hostnames =
   hosts_require_tls =  *
   hosts_require_ocsp = *

diff --git a/test/confs/5658 b/test/confs/5658
index de486e083f3d370246b45ed5008c56699beb1625..6a75b8c675e315a5115f7147e9b2e0b626e1c6ae 100644 (file)
--- a/test/confs/5658
+++ b/test/confs/5658
@@ -125,6 +125,7 @@ send_to_server3:
   helo_data = helo.data.changed
   #tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem
   tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/CA/CA.pem
+  tls_try_verify_hosts =
   tls_verify_cert_hostnames =
   hosts_require_tls =  *
   hosts_require_ocsp = *

diff --git a/test/confs/5750 b/test/confs/5750
index d1e2e7ce05c42c783e8ae7665d9da247869beaf3..98fd46f7d05cf5479e07686a5d120f80df59cd06 100644 (file)
--- a/test/confs/5750
+++ b/test/confs/5750
@@ -104,6 +104,7 @@ send_to_server:
        ${if eq {$local_part}{good}\
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
+  tls_try_verify_hosts =
   tls_verify_cert_hostnames =
 
   event_action =   ${acl {logger} {$event_name} {$domain} }

diff --git a/test/confs/5760 b/test/confs/5760
index 80dde3e151b22f1789b07adc38a36b7dbb269ec4..03d1a6b0a84d823205f9c9df2aa3cdbcea6cf492 100644 (file)
--- a/test/confs/5760
+++ b/test/confs/5760
@@ -105,6 +105,7 @@ send_to_server:
 {example.com/server1.example.com/ca_chain.pem}\
 {example.net/server1.example.net/ca_chain.pem}}
   tls_verify_cert_hostnames =
+  tls_try_verify_hosts =
 
   event_action =   ${acl {logger} {$event_name} {$domain} }
 

diff --git a/test/log/2100 b/test/log/2100
index 02b6f0e607971f923a95dfb508fbf57a144494c0..9c57bffcc20d0f37a75100117e088ef5c2e86a89 100644 (file)
--- a/test/log/2100
+++ b/test/log/2100
@@ -1,14 +1,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
-1999-03-02 09:44:33 10HmaX-0005vi-00 H=127.0.0.1 [127.0.0.1] TLS error on connection (SSL_connect): error: <<detail omitted>>
-1999-03-02 09:44:33 10HmaX-0005vi-00 TLS session failure: delivering unencrypted to 127.0.0.1 [127.0.0.1] (not in hosts_require_tls)
-1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 TLS error on connection from localhost (myhost.test.ex) [127.0.0.1] (SSL_accept): error: <<detail omitted>>
-1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
-1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtp S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtps X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" S=sss id=E10HmaX-0005vi-00@myhost.test.ex

diff --git a/test/log/2107 b/test/log/2107
index 5d3817accebb49f2ee19ffc2f4d3bfc7a2ca67a0..73b5d8e59fe848e5c244959d38f1fcfb7145fb77 100644 (file)
--- a/test/log/2107
+++ b/test/log/2107
@@ -1,5 +1,8 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/log/2108 b/test/log/2108
index 12ab295f494ea7b2d5c88f4a6b9d29cb87ae5685..b727ccb55d24b94796051badf0c2300d57f4d386 100644 (file)
--- a/test/log/2108
+++ b/test/log/2108
@@ -1,10 +1,19 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
 1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaZ-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaY-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
 1999-03-02 09:44:33 10HmaY-0005vi-00 => CALLER@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 -> xyz@test.ex R=client T=send_to_server1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbA-0005vi-00"
+1999-03-02 09:44:33 10HmaY-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaY-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
 1999-03-02 09:44:33 10HmaY-0005vi-00 => abcd@test.ex R=client T=send_to_server2 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmbB-0005vi-00"
 1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/log/2110 b/test/log/2110
index 72f08dc2020aba84688e1139f1ff7c86f71763e6..574b1b7b855bd63a463c0406442a9b54d16f0c83 100644 (file)
--- a/test/log/2110
+++ b/test/log/2110
@@ -1,6 +1,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=127.0.0.1 [127.0.0.1]: a TLS session is required, but the server did not offer TLS support
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/log/2111 b/test/log/2111
index 0fef3f4089ea153c4aeeb7203f4f7ef8e551f8cf..584c3deb5e4b989c508f2688e8e0d1268c6f81de 100644 (file)
--- a/test/log/2111
+++ b/test/log/2111
@@ -1,6 +1,9 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
 1999-03-02 09:44:33 10HmaX-0005vi-00 H=ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4] TLS error on connection (SSL_connect): error: <<detail omitted>>
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+1999-03-02 09:44:33 10HmaX-0005vi-00 SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
 1999-03-02 09:44:33 10HmaX-0005vi-00 => userx@test.ex R=client T=send_to_server H=127.0.0.1 [127.0.0.1] X=TLSv1:DES-CBC3-SHA:168 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
 1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf

diff --git a/test/stderr/2108 b/test/stderr/2108
index 743f7ba713da53467fcf58cd9cb9c97af09ee1d9..3d6d87643746747bd049725e2f7c9031eb9b62cb 100644 (file)
--- a/test/stderr/2108
+++ b/test/stderr/2108
@@ -12,6 +12,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
+LOG: MAIN
+  SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+LOG: MAIN
+  SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
   SMTP>> EHLO helo.data.changed
   SMTP<< 250-myhost.test.ex Hello helo.data.changed [127.0.0.1]
          250-SIZE 52428800
@@ -43,6 +48,11 @@ Connecting to 127.0.0.1 [127.0.0.1]:1225 ... connected
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
+LOG: MAIN
+  SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+LOG: MAIN
+  SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
   SMTP>> EHLO helo.data.changed
   SMTP<< 250-myhost.test.ex Hello helo.data.changed [127.0.0.1]
          250-SIZE 52428800
@@ -75,6 +85,11 @@ Connecting to ip4.ip4.ip4.ip4 [ip4.ip4.ip4.ip4]:1225 ... connected
          250 HELP
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
+LOG: MAIN
+  SSL verify error: depth=0 error=self signed certificate cert=/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock
+LOG: MAIN
+  SSL verify error: certificate name mismatch: "/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock"
+
   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800

diff --git a/test/stderr/5410 b/test/stderr/5410
index 943681e1370873acf63fc5c90ac54d285c6f7753..54a99c7ed83f05f809fe014b5387f402c9c8a663 100644 (file)
--- a/test/stderr/5410
+++ b/test/stderr/5410
@@ -83,7 +83,8 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
   SMTP<< 220 TLS go ahead
 127.0.0.1 in hosts_require_ocsp? no (option unset)
 127.0.0.1 in hosts_request_ocsp? yes (matched "*")
-127.0.0.1 in tls_verify_cert_hostnames? yes (matched "*")
+127.0.0.1 in tls_verify_hosts? no (option unset)
+127.0.0.1 in tls_try_verify_hosts? no (end of list)
   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800

diff --git a/test/stderr/5420 b/test/stderr/5420
index 464cb2c4d2f8406ba31d5feb3ea5f953f292160f..f08ae8e9e75307c21fce36b34a5c568adb3237d8 100644 (file)
--- a/test/stderr/5420
+++ b/test/stderr/5420
@@ -82,7 +82,8 @@ expanding: ${if eq {$address_data}{userz}{*}{:}}
   SMTP>> STARTTLS
   SMTP<< 220 TLS go ahead
 127.0.0.1 in tls_verify_hosts? no (option unset)
-127.0.0.1 in tls_try_verify_hosts? no (option unset)
+127.0.0.1 in tls_try_verify_hosts? yes (matched "*")
+127.0.0.1 in tls_verify_cert_hostnames? yes (matched "*")
   SMTP>> EHLO myhost.test.ex
   SMTP<< 250-myhost.test.ex Hello the.local.host.name [ip4.ip4.ip4.ip4]
          250-SIZE 52428800