Docs: add warning on OCSP must-staple certs vs. client-cert use.

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index a164835033c887cb0a78240eb8fc08e50ef81e03..d21a718572711faf26f89bb7b0815897dd0865e1 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -6628,9 +6628,10 @@ of the JSON structure.
 If a selector is numeric, it must apply to a JSON array; the (zero-based)
 nunbered array element is selected.
 Otherwise it must apply to a JSON object; the named element is selected.
-The final resulting object can be a simple JSOM type or a JSON object
+The final resulting element can be a simple JSON type or a JSON object
 or array; for the latter two a string-representation os the JSON
 is returned.
+For elements of type string, the returned value is de-quoted.
 .wen
 .next
 .cindex "linear search"
@@ -9424,6 +9425,8 @@ The expanded <&'string1'&> must be of the form:
 The braces, commas and colons, and the quoting of the member name are required;
 the spaces are optional.
 Matching of the key against the member names is done case-sensitively.
+If a returned value is a JSON string, it retains its leading and
+trailing quotes.
 . XXX should be a UTF-8 compare
 
 The results of matching are handled as above.
@@ -9471,6 +9474,8 @@ apart from leading and trailing white space, which is ignored.
 
 Field selection and result handling is as above;
 there is no choice of field separator.
+If a returned value is a JSON string, it retains its leading and
+trailing quotes.
 .wen
 
 
@@ -28197,6 +28202,15 @@ checks are made: that the host name (the one in the DNS A record)
 is valid for the certificate.
 The option defaults to always checking.
 
+.new
+Do not use a client certificate that contains an "OCSP Must-Staple" extension.
+TLS 1.2 and below does not support client-side OCSP stapling, and
+(as of writing) the TLS libraries do not provide for it even with
+TLS 1.3.
+Be careful when using the same certificate for server- and
+client-certificate for this reason.
+.wen
+
 The &(smtp)& transport has two OCSP-related options:
 &%hosts_require_ocsp%&; a host-list for which a Certificate Status
 is requested and required for the connection to proceed.  The default