diff options
| -rw-r--r-- | doc/doc-docbook/spec.xfpt | 3 | ||||
| -rw-r--r-- | doc/doc-txt/ChangeLog | 6 | ||||
| -rw-r--r-- | src/src/tls-openssl.c | 2 |
3 files changed, 10 insertions, 1 deletions
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 9c03523bb..92d0a2287 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -16066,6 +16066,9 @@ use OpenSSL with a directory. See &<<SECTtlssni>>& for discussion of when this option might be re-expanded. +A forced expansion failure or setting to an empty string is equivalent to +being unset. + .option tls_verify_hosts main "host list&!!" unset .cindex "TLS" "client certificate verification" diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index c8155aa5c..a2e204d34 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -175,6 +175,12 @@ PP/17 Update configure.default to handle IPv6 localhost better. Patch by Alain Williams (plus minor tweaks). Bugzilla 880. +PP/18 OpenSSL made graceful with empty tls_verify_certificates setting. + This is now consistent with GnuTLS, and is now documented: the + previous undocumented portable approach to treating the option as + unset was to force an expansion failure. That still works, and + an empty string is now equivalent. + Exim version 4.80.1 ------------------- diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index d879f0873..42afd3949 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -1008,7 +1008,7 @@ uschar *expcerts, *expcrl; if (!expand_check(certs, US"tls_verify_certificates", &expcerts)) return DEFER; -if (expcerts != NULL) +if (expcerts != NULL && *expcerts != '\0') { struct stat statbuf; if (!SSL_CTX_set_default_verify_paths(sctx)) |