diff options
Diffstat (limited to 'doc/doc-txt/experimental-spec.txt')
| -rw-r--r-- | doc/doc-txt/experimental-spec.txt | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index 266e19891..f6529c6e2 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -1154,14 +1154,17 @@ support to date has not made these checks. If built with EXPERIMENTAL_CERTNAMES defined, code is included to do so for server certificates, and a new smtp transport option -"tls_verify_cert_hostnames" supported which takes a list of -names for which the additional checks must be made. +"tls_verify_cert_hostnames" supported which takes a hostlist +which must match the target host for the additional checks must be made. The option currently defaults to empty, but this may change in the future. "*" is probably a suitable value. Whether certificate verification is done at all, and the result of it failing, is stll under the control of "tls_verify_hosts" nad "tls_try_verify_hosts". +The name being checked is that for the host, generally +the result of an MX lookup. + Both Subject and Subject-Alternate-Name certificate fields are supported, as are wildcard certificates (limited to a single wildcard being the initial component of a 3-or-more |