From 8d69247061599b35b60308ca4b75ba529b8dcba2 Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Sun, 26 Oct 2014 21:06:46 +0000 Subject: Do not permit multi-component wildcards on certificate names (OpenSSL) --- doc/doc-txt/ChangeLog | 5 +++++ doc/doc-txt/experimental-spec.txt | 16 ++++++++++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) (limited to 'doc') diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index ed4574729..b389a7deb 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -59,6 +59,11 @@ JH/08 Rename the TPDA expermimental facility to Event Actions. The #ifdef raised for inbound connections, if the main configuration event_action option is defined. +JH/09 When compiled with OpenSSL and EXPERIMENTAL_CERTNAMES, the checks on + server certificate names available under the smtp transport option + "tls_verify_cert_hostname" now do not permit multi-component wildcard + matches. + Exim version 4.84 ----------------- diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index faa64df68..8192f3d76 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -1144,6 +1144,8 @@ the next hop does not support DSN. Adding it to a redirect router makes no difference. + + Certificate name checking -------------------------------------------------------------- The X509 certificates used for TLS are supposed be verified @@ -1151,7 +1153,7 @@ that they are owned by the expected host. The coding of TLS support to date has not made these checks. If built with EXPERIMENTAL_CERTNAMES defined, code is -included to do so, and a new smtp transport option +included to do so for server certificates, and a new smtp transport option "tls_verify_cert_hostname" supported which takes a list of names for which the checks must be made. The host must also be in "tls_verify_hosts". @@ -1161,6 +1163,16 @@ are supported, as are wildcard certificates (limited to a single wildcard being the initial component of a 3-or-more component FQDN). +The equivalent check on the server for client certificates is not +implemented. At least one major email provider is using a client +certificate which fails this check. They do not retry either without +hte client certificate or in clear. + +It is possible to duplicate the effect of this checking by +creative use of Events. + + + DANE ------------------------------------------------------------ @@ -1304,7 +1316,7 @@ in the delivery log line will show as "CV=dane". There is a new variable $tls_out_dane which will have "yes" if verification succeeded using DANE and "no" otherwise (only useful -in combination with EXPERIMENTAL_TPDA), and a new variable +in combination with EXPERIMENTAL_EVENT), and a new variable $tls_out_tlsa_usage (detailed above). -- cgit v1.2.3