Verifiable conn with DANE-EE(3) / SPKI(1) / SHA2-512(2)

4 files changed, 9 insertions, 17 deletions

diff --git a/test/confs/5850 b/test/confs/5850
index 0b132e29e..cd4ccc59f 100644
--- a/test/confs/5850
+++ b/test/confs/5850
@@ -26,10 +26,7 @@ tls_advertise_hosts = *
 # Set certificate only if server
 
 tls_certificate = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
-tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
-
-#tls_verify_hosts = *
-#tls_verify_certificates = ${if eq {SERVER}{server}{DIR/aux-fixed/cert2}fail}
+#tls_privatekey = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail}
 
 
 # ----- Routers -----
@@ -39,7 +36,6 @@ begin routers
 client:
   driver = dnslookup
   condition = ${if eq {SERVER}{server}{no}{yes}}
-#  retry_use_local_part
   dnssec_request_domains = *
   self = send
   transport = send_to_server
@@ -56,11 +52,7 @@ begin transports
 send_to_server:
   driver = smtp
   allow_localhost
-#  hosts = 127.0.0.1
   port = PORT_D
-#  tls_certificate = DIR/aux-fixed/cert2
-#  tls_privatekey = DIR/aux-fixed/cert2
-#  tls_verify_certificates = DIR/aux-fixed/cert2
 
 #  hosts_try_dane = *
   hosts_require_dane = *
diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex
index bd334918b..fed44daf9 100644
--- a/test/dnszones-src/db.test.ex
+++ b/test/dnszones-src/db.test.ex
@@ -82,7 +82,7 @@ v6           AAAA    V6NET:ffff:836f:0a00:000a:0800:200a:c032
 DNSSEC eximtesthost     A       HOSTIPV4
 alias-eximtesthost CNAME eximtesthost.test.ex.
 
-DNSSEC _1225._tcp.eximtesthost	TLSA	3 1 2 f000baaa
+DNSSEC _1225._tcp.eximtesthost	TLSA	3 1 2 3d5eb81b1dfc3f93c1fa8819e3fb3fdb41bb590441d5f3811db17772f4bc6de29bdd7c4f4b723750dda871b99379192b3f979f03db1252c4f08b03ef7176528d
 
 ; A bad CNAME
 
diff --git a/test/log/5850 b/test/log/5850
index e8b37bb61..aad1ade98 100644
--- a/test/log/5850
+++ b/test/log/5850
@@ -1,14 +1,13 @@
 1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 TLS error on connection to eximtesthost.test.ex [ip4.ip4.ip4.ip4] (tlsa load): error:8006C067:DANE library:func(108):Bad TLSA record digest
-1999-03-02 09:44:33 10HmaX-0005vi-00 == CALLER@mxplain.test.ex R=client T=send_to_server defer (-37): failure while setting up TLS session
+1999-03-02 09:44:33 10HmaX-0005vi-00 => CALLER@mxplain.test.ex R=client T=send_to_server H=eximtesthost.test.ex [ip4.ip4.ip4.ip4] X=TLSv1:AES256-SHA:256 DN="/C=UK/O=The Exim Maintainers/OU=Test Suite/CN=Phil Pennock" C="250 OK id=10HmaY-0005vi-00"
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
 
 ******** SERVER ********
 1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
-1999-03-02 09:44:33 TLS error on connection from the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] (SSL_accept): error: <<detail omitted>>
-1999-03-02 09:44:33 TLS client disconnected cleanly (rejected our certificate?)
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=the.local.host.name (myhost.test.ex) [ip4.ip4.ip4.ip4] P=esmtps X=TLSv1:AES256-SHA:256 S=sss id=E10HmaX-0005vi-00@myhost.test.ex
 1999-03-02 09:44:33 Start queue run: pid=pppp -qf
-1999-03-02 09:44:33 10HmaX-0005vi-00 => :blackhole: <CALLER@mxplain.test.ex> R=server
-1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <CALLER@mxplain.test.ex> R=server
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
 1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/scripts/5850-DANE-OpenSSL/5850 b/test/scripts/5850-DANE-OpenSSL/5850
index 963bf4f4e..449a75bf6 100644
--- a/test/scripts/5850-DANE-OpenSSL/5850
+++ b/test/scripts/5850-DANE-OpenSSL/5850
@@ -2,10 +2,11 @@
 #
 exim -DSERVER=server -bd -oX PORT_D
 ****
+# TLSA (3 1 2)
 exim CALLER@mxplain.test.ex
 Testing
 ****
-exim -d+all -qf
+exim -qf
 ****
 killdaemon
 exim -DSERVER=server -DNOTDAEMON -qf