diff options
author | Jeremy Harris <jgh146exb@wizmail.org> | 2014-11-06 21:22:18 +0000 |
---|---|---|
committer | Jeremy Harris <jgh146exb@wizmail.org> | 2014-11-06 21:22:18 +0000 |
commit | a320fabd09f43c02c869c90a5a5a70a49dd77f89 (patch) | |
tree | 341ccb129d815e0c2daa6c0b8531fc0d4756eb7d /doc/doc-txt | |
parent | 09c17790eec23907b93df1ec7cee746b28dfc836 (diff) |
EXPERIMENTAL_CERTNAMES: Hostlist for cert name checks should match host
connected-to, not be list of acceptable names. The name checked is the
host name.
Diffstat (limited to 'doc/doc-txt')
-rw-r--r-- | doc/doc-txt/experimental-spec.txt | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index 266e19891..f6529c6e2 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -1154,14 +1154,17 @@ support to date has not made these checks. If built with EXPERIMENTAL_CERTNAMES defined, code is included to do so for server certificates, and a new smtp transport option -"tls_verify_cert_hostnames" supported which takes a list of -names for which the additional checks must be made. +"tls_verify_cert_hostnames" supported which takes a hostlist +which must match the target host for the additional checks must be made. The option currently defaults to empty, but this may change in the future. "*" is probably a suitable value. Whether certificate verification is done at all, and the result of it failing, is stll under the control of "tls_verify_hosts" nad "tls_try_verify_hosts". +The name being checked is that for the host, generally +the result of an MX lookup. + Both Subject and Subject-Alternate-Name certificate fields are supported, as are wildcard certificates (limited to a single wildcard being the initial component of a 3-or-more |