.cindex "TLS" "server certificate; location of"
.cindex "certificate" "server, location of"
The value of this option is expanded, and must then be a list of absolute paths to
-files which contains the server's certificates. Commonly only one file is
-needed.
+files which contain the server's certificates (in PEM format).
+Commonly only one file is needed.
The server's private key is also
assumed to be in this file if &%tls_privatekey%& is unset. See chapter
&<<CHAPTLS>>& for further details.
attacks in the string (&`../`& or SQL), and ensuring that a valid filename
can always be referenced; it is important to remember that &$tls_in_sni$& is
arbitrary unverified data provided prior to authentication.
-Further, the initial certificate is loaded before SNI is arrived, so
+Further, the initial certificate is loaded before SNI has arrived, so
an expansion for &%tls_certificate%& must have a default which is used
when &$tls_in_sni$& is empty.
while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
{
uschar rbuffer[256];
- int searchtype = (type == T_CSA)? T_SRV : /* record type we want */
- (type == T_MXH)? T_MX :
- (type == T_ZNS)? T_NS : type;
+ int searchtype = type == T_CSA ? T_SRV : /* record type we want */
+ type == T_MXH ? T_MX :
+ type == T_ZNS ? T_NS : type;
/* If the type is PTR or CSA, we have to construct the relevant magic lookup
key if the original is an IP address (some experimental protocols are using
/* Unfortunately, we cannot set the mx_only option in advance, because the
DNS lookup may extend an unqualified name. Therefore, we must do the test
- stoubsequently. We use the same logic as that for widen_domains above to avoid
+ subsequently. We use the same logic as that for widen_domains above to avoid
requesting a header rewrite that cannot work. */
if (verify != v_sender || !ob->rewrite_headers || addr->parent)