Package: sendmail-bin
Version: 8.18.2-2
Severity: normal
Tags: patch
Dear Maintainer,
I was having certificate failures when sending mail to a sendmail
submission server and traced the issue down to sendmail not sending the
entire cert chain. The reason is that it uses
SSL_CTX_use_certificate_file() to read the file and not
SSL_CTX_use_certificate_chain_file(). Poking around the sendmail source
I noticed that this was gated behind the
_FFR_TLS_USE_CERTIFICATE_CHAIN_FILE define. I made a patch to
debian/configure.ac to add that, rebuilt the package, and verified that
it now sends the whole cert chain.
I've attached the patch.
I think it's an important feature--nowadays most "real" SSL certs have
intermediates in them, especially in the LetsEncrypt/ACME space, and
sendmail will not produce a validating cert chain unless this option is
enabled.
Thanks,
David
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.17.13+deb14-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE
not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages sendmail-bin depends on:
ii debconf 1.5.92
ii libc6 2.42-17
ii libdb5.3t64 5.3.28+dfsg2-11+b1
ii libldap2 2.6.13+dfsg-1
ii liblockfile1 1.17-2+b2
ii libnsl3 2.0.1-2
ii libsasl2-2 2.1.28+dfsg1-11
ii libssl3t64 3.6.3-1
ii libwrap0 7.6.q-37
ii procps 2:4.0.6-2
ii sendmail-base 8.18.2-2
ii sendmail-cf 8.18.2-2
sendmail-bin recommends no packages.
Versions of packages sendmail-bin suggests:
ii libsasl2-modules 2.1.28+dfsg1-11
ii openssl 3.6.3-1
ii sasl2-bin 2.1.28+dfsg1-11
ii sendmail-doc 8.18.2-2
Versions of packages sensible-mda depends on:
ii libc6 2.42-17
ii procmail 3.24+really3.22-6
Versions of packages rmail depends on:
ii libc6 2.42-17
ii libldap2 2.6.13+dfsg-1
Versions of packages libmilter1.0.1 depends on:
ii libc6 2.42-17
Versions of packages sendmail depends on:
ii sendmail-base 8.18.2-2
ii sendmail-cf 8.18.2-2
ii sensible-mda 8.18.2-2
Versions of packages sendmail suggests:
ii rmail 8.18.2-2
ii sendmail-doc 8.18.2-2
-- no debconf information
From fc747debdbec241c719257ed493006bed7bda7bb Mon Sep 17 00:00:00 2001
From: David Caldwell <[email protected]>
Date: Thu, 30 Jul 2026 14:00:49 -0700
Subject: [PATCH] Make certificate chains work in TLS with a "FFR" flag ("For
Future Release")
Specifically: _FFR_TLS_USE_CERTIFICATE_CHAIN_FILE
Without this, STARTTLS only offers up the first cert in the file.
---
debian/configure.ac | 2 ++
1 file changed, 2 insertions(+)
diff --git a/debian/configure.ac b/debian/configure.ac
index 7a78853..229195a 100644
--- a/debian/configure.ac
+++ b/debian/configure.ac
@@ -1428,6 +1428,8 @@ if test $sm_enable_tls != no; then
sm_suggests="$sm_suggests, openssl";
sm_sendmail_envdef="$sm_sendmail_envdef -DSTARTTLS";
sm_sendmail_envdef="$sm_sendmail_envdef -DDANE=1"
+ # Make TLS send the whole cert chain instead of the
topmost cert in a cert chain file.
+ sm_sendmail_envdef="$sm_sendmail_envdef
-D_FFR_TLS_USE_CERTIFICATE_CHAIN_FILE=1"
sm_sendmail_libs="$sm_sendmail_libs -lcrypto -lssl";
sm_ffr="$sm_ffr -D_FFR_TLS_EC";
elif test $sm_enable_tls = auto; then
--
2.53.0
