TLS: variables $tls_(in,out)_tlsver
[exim.git] / test / confs / 2002
CommitLineData
afda344b
PH
1# Exim test configuration 2002
2
d4dc049f
JH
3.include DIR/aux-var/tls_conf_prefix
4
e9477a08 5timezone = UTC
d4dc049f 6primary_hostname = myhost.test.ex
afda344b
PH
7
8# ----- Main settings -----
9
10acl_smtp_rcpt = check_recipient
11
12log_selector = +tls_peerdn
13
14queue_only
15queue_run_in_order
16
17tls_advertise_hosts = 127.0.0.1 : HOSTIPV4
18
ba86e143
JH
19CA = DIR/aux-fixed/exim-ca
20DRSA = CA/example.com
21DECDSA = CA/example_ec.com
22
23tls_certificate = DRSA/server1.example.com/server1.example.com.pem \
24 : DECDSA/server1.example_ec.com/server1.example_ec.com.pem
25tls_privatekey = DRSA/server1.example.com/server1.example.com.unlocked.key \
26 : DECDSA/server1.example_ec.com/server1.example_ec.com.unlocked.key
afda344b
PH
27
28tls_verify_hosts = HOSTIPV4
ba86e143 29tls_verify_certificates = DRSA/server2.example.com/ca_chain.pem
afda344b
PH
30
31
32# ------ ACL ------
33
34begin acl
35
36check_recipient:
37 accept hosts = :
38 deny hosts = HOSTIPV4
ba86e143 39 !encrypted = *
9d1c15ef
JH
40 warn logwrite = ${if def:tls_in_ourcert \
41 {Our cert SN: <${certextract{subject}{$tls_in_ourcert}}>} \
42 {We did not present a cert}}
43 accept condition = ${if !def:tls_in_peercert}
44 logwrite = Peer did not present a cert
45 accept logwrite = Peer cert:
46 logwrite = ver ${certextract {version}{$tls_in_peercert}}
47 logwrite = SR <${certextract {serial_number}{$tls_in_peercert}}>
48 logwrite = SN <${certextract {subject} {$tls_in_peercert}}>
49 logwrite = IN <${certextract {issuer} {$tls_in_peercert}}>
812a6045 50 logwrite = IN/O <${certextract {issuer,O} {$tls_in_peercert}}>
e4b6aa96
JH
51 logwrite = NB/r <${certextract {notbefore,raw} {$tls_in_peercert}}>
52 logwrite = NB <${certextract {notbefore} {$tls_in_peercert}}>
25ba2544 53 logwrite = NB/i <${certextract {notbefore,int}{$tls_in_peercert}}>
e4b6aa96
JH
54 logwrite = NA/i <${certextract {notafter,int} {$tls_in_peercert}}>
55 logwrite = NA <${certextract {notafter} {$tls_in_peercert}}>
9e4dddbd 56 logwrite = SA <${certextract {sig_algorithm}{$tls_in_peercert}}>
9d1c15ef 57 logwrite = SG <${certextract {signature} {$tls_in_peercert}}>
9e4dddbd 58 logwrite = ${certextract {subj_altname} {$tls_in_peercert} {SAN <$value>}{(no SAN)}}
9d1c15ef
JH
59# logwrite = ${certextract {ocsp_uri} {$tls_in_peercert} {OCU <$value>}{(no OCU)}}
60 logwrite = ${certextract {crl_uri} {$tls_in_peercert} {CRU <$value>}{(no CRU)}}
9ef9101c 61 logwrite = md5 fingerprint ${md5:$tls_in_peercert}
e4b6aa96 62 logwrite = sha1 fingerprint ${sha1:$tls_in_peercert}
9ef9101c 63 logwrite = sha256 fingerprint ${sha256:$tls_in_peercert}
59b87190 64 logwrite = der_b64 ${base64:$tls_in_peercert}
5b195d6b
JH
65 logwrite = cipher: $tls_in_cipher
66 logwrite = cipher_ $tls_in_cipher_std
67 logwrite = ver: $tls_in_ver
afda344b
PH
68
69
70# ----- Routers -----
71
72begin routers
73
74abc:
75 driver = accept
76 retry_use_local_part
77 transport = local_delivery
78 headers_add = tls-certificate-verified: $tls_certificate_verified
79
80
81# ----- Transports -----
82
83begin transports
84
85local_delivery:
86 driver = appendfile
87 file = DIR/test-mail/$local_part
88 headers_add = TLS: cipher=$tls_cipher peerdn=$tls_peerdn
89 user = CALLER
90
91# End