TLS: variables $tls_(in,out)_tlsver
[exim.git] / test / confs / 5710
CommitLineData
4b4a0e99 1# Exim test configuration 5710 (dup of 5720)
9d1c15ef
JH
2# $tls_out_peercert - GnuTLS
3
4SERVER=
5
d4dc049f
JH
6.include DIR/aux-var/tls_conf_prefix
7
9d1c15ef 8primary_hostname = myhost.test.ex
e9477a08 9timezone = UTC
9d1c15ef
JH
10
11# ----- Main settings -----
12
13acl_smtp_rcpt = accept
14
15log_selector = +tls_peerdn
16
17queue_only
18queue_run_in_order
19
20tls_advertise_hosts = *
21
22tls_certificate = DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem
23tls_privatekey = DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.unlocked.key
24
25tls_verify_hosts = *
26tls_verify_certificates = DIR/aux-fixed/exim-ca/example.com/server2.example.com/ca_chain.pem
27
723fe533
JH
28event_action = ${acl {server_cert_log}}
29
9d1c15ef
JH
30#
31
32begin acl
a7538db1 33
723fe533
JH
34server_cert_log:
35 accept condition = ${if eq {tls:cert}{$event_name}}
36 logwrite = [$sender_host_address] \
37 depth=$event_data \
38 ${certextract{subject}{$tls_in_peercert}}
39 accept
40
a7538db1 41ev_tls:
774ef2d7 42 accept logwrite = $event_name depth=$event_data \
a7538db1
JH
43 <${certextract {subject} {$tls_out_peercert}}>
44# message = noooo
45
46ev_msg:
47 warn logwrite = $acl_arg1 $local_part
9d1c15ef 48 warn logwrite = ${if !def:tls_out_ourcert \
a7538db1 49 {NO CLIENT CERT presented} \
9d1c15ef
JH
50 {Our cert SN: ${certextract{subject}{$tls_out_ourcert}}}}
51 accept condition = ${if !def:tls_out_peercert}
52 logwrite = No Peer cert
53 accept logwrite = Peer cert:
54 logwrite = ver <${certextract {version} {$tls_out_peercert}}>
55 logwrite = SN <${certextract {subject} {$tls_out_peercert}}>
bfbad1dd
JH
56 logwrite = SN; <${certextract {subject,>;} {$tls_out_peercert}}>
57 logwrite = SNCN<${certextract {subject,CN} {$tls_out_peercert}}>
9d1c15ef
JH
58 logwrite = IN <${certextract {issuer} {$tls_out_peercert}}>
59 logwrite = NB <${certextract {notbefore} {$tls_out_peercert}}>
60 logwrite = NA <${certextract {notafter} {$tls_out_peercert}}>
9e4dddbd 61 logwrite = SA <${certextract {sig_algorithm} {$tls_out_peercert}}>
9d1c15ef 62 logwrite = SG <${certextract {signature} {$tls_out_peercert}}>
9e4dddbd 63 logwrite = ${certextract {subj_altname} {$tls_out_peercert}{SAN <$value>}{(no SAN)}}
348051ad 64# logwrite = ${certextract {ocsp_uri} {$tls_out_peercert} {OCU <$value>}{(no OCU)}}
9d1c15ef
JH
65 logwrite = ${certextract {crl_uri} {$tls_out_peercert} {CRU <$value>}{(no CRU)}}
66
a7538db1 67logger:
774ef2d7
JH
68 accept condition = ${if eq {msg} {${listextract{1}{$event_name}}}}
69 acl = ev_msg $event_name $acl_arg2
70 accept condition = ${if eq {tls} {${listextract{1}{$event_name}}}}
a7538db1 71 message = ${acl {ev_tls}}
8e78571a
JH
72 accept condition = ${if eq {smtp:ehlo}{$event_name}}
73 logwrite = $tls_out_cipher smtp:ehlo $event_data
5b195d6b
JH
74 logwrite = cipher_ $tls_out_cipher_std
75 logwrite = ver: $tls_out_ver
a7538db1 76 accept
9d1c15ef
JH
77
78# ----- Routers -----
79
80begin routers
81
82client:
83 driver = accept
84 condition = ${if eq {SERVER}{server}{no}{yes}}
85 retry_use_local_part
86 transport = send_to_server
87
88
89# ----- Transports -----
90
91begin transports
92
93send_to_server:
94 driver = smtp
95 allow_localhost
96 hosts = 127.0.0.1
97 port = PORT_D
98
99 tls_certificate = DIR/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.pem
100 tls_privatekey = DIR/aux-fixed/exim-ca/example.com/server2.example.com/server2.example.com.unlocked.key
101
102 tls_verify_certificates = DIR/aux-fixed/exim-ca/\
103 ${if eq {$local_part}{good}\
104{example.com/server1.example.com/ca_chain.pem}\
105{example.net/server1.example.net/ca_chain.pem}}
610ff438 106 tls_try_verify_hosts =
01a4a5c5 107 tls_verify_cert_hostnames =
9d1c15ef 108
774ef2d7 109 event_action = ${acl {logger} {$event_name} {$domain} }
9d1c15ef
JH
110
111# ----- Retry -----
112
113
114begin retry
115
116* * F,5d,10s
117
118
119# End