From e51c7be22dfccad376659a1a46cee93c9979bbf7 Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Tue, 20 May 2014 21:25:10 +0100 Subject: Support optional server certificate name checking. Bug 1479 Enable EXPERIMENTAL_CERTNAMES to include. --- doc/doc-txt/experimental-spec.txt | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'doc') diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index d8c26bf93..588543454 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -1147,6 +1147,25 @@ QUIT +Certificate name checking +-------------------------------------------------------------- +The X509 certificates used for TLS are supposed be verified +that they are owned by the expected host. The coding of TLS +support to date has not made these checks. + +If built with EXPERIMENTAL_CERTNAMES defined, code is +included to do so, and a new smtp transport option +"tls_verify_cert_hostname" supported which takes a list of +names for which the checks must be made. The host must +also be in "tls_verify_hosts". + +Both Subject and Subject-Alternate-Name certificate fields +are supported, as are wildcard certificates (limited to +a single wildcard being the initial component of a 3-or-more +component FQDN). + + + -------------------------------------------------------------- End of file -------------------------------------------------------------- -- cgit v1.2.3