OpenSSL: Capture peercert/dn in mainline not verify-callback. Bug 1571

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index dfe0432c66c70d85d91db631de0e7adfd81ac788..a112ec7e950aa56e5c05fb6a491123d6f3bff001 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -12451,6 +12451,8 @@ inbound connection when the message was received.
 It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
 or a &%def%& condition.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
 
 .vitem &$tls_out_ourcert$&
 .vindex "&$tls_out_ourcert$&"
@@ -12465,6 +12467,8 @@ This variable refers to the certificate presented by the peer of an
 outbound connection.  It is only useful as the argument of a
 &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
 or a &%def%& condition.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
 
 .vitem &$tls_in_certificate_verified$&
 .vindex "&$tls_in_certificate_verified$&"
@@ -12528,6 +12532,8 @@ When a message is received from a remote host over an encrypted SMTP
 connection, and Exim is configured to request a certificate from the client,
 the value of the Distinguished Name of the certificate is made available in the
 &$tls_in_peerdn$& during subsequent processing.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
 
 The deprecated &$tls_peerdn$& variable refers to the inbound side
 except when used in the context of an outbound SMTP delivery, when it refers to
@@ -12539,6 +12545,8 @@ When a message is being delivered to a remote host over an encrypted SMTP
 connection, and Exim is configured to request a certificate from the server,
 the value of the Distinguished Name of the certificate is made available in the
 &$tls_out_peerdn$& during subsequent processing.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
 
 .vitem &$tls_in_sni$&
 .vindex "&$tls_in_sni$&"
@@ -30874,6 +30882,12 @@ have multiple recipients, not necessarily all in the same domain. Because the
 &%spam%& condition has to be called from a DATA ACL in order to be able to
 read the contents of the message, the variables &$local_part$& and &$domain$&
 are not set.
+Careful enforcement of single-recipient messages
+(eg. by responding with defer in the recipient ACL for all recipients
+after the first),
+or the use of PRDR,
+.cindex "PRDR" "use for per-user SpamAssassin profiles"
+are needed to use this feature.
 
 The right-hand side of the &%spam%& condition is expanded before being used, so
 you can put lookups or conditions there. When the right-hand side evaluates to