On 2010-08-02 Andreas Metzler <[email protected]> wrote: [...] > Anyway, the behavior of the two TLS implementation used in exim4 seems > to differ when none of the certificates available are listed as > acceptable by the server. (In the respective handshake for X-509 certs > the server basically says "Please show me your cert, the list of > acceptable ones is this one.") In this situation exim4's GnuTLS > implementation does not send any cert, the OpenSSL code does. [...]
Hello, And exactly this seems to be the case here. smtp.cjsm.net does not say which client certs are acceptable: ametz...@argenau:~$ openssl s_client -state -connect smtp.cjsm.net:25 -starttls smtp [...] --- No client certificate CA names sent --- [...] While on the other hand if I configure exim to request client certs signed by cjsm's CA (by pointing MAIN_TLS_VERIFY_CERTIFICATES to a file containing just this cert and setting MAIN_TLS_TRY_VERIFY_HOSTS) I will get this. (No matter whether exim is linked against OpenSSL or GnuTLS.): [...] --- Acceptable client certificate CA names /C=GB/ST=Wiltshire/L=Swindon/O=Cable & Wireless plc/OU=CJIT Secure Mail/CN=Criminal Justice IT Root CA (CJSM)/[email protected] --- [...] As I said previously in this szenario GnuTLSed exim won't send client certificates. It would be possible to change this, the GnuTLS interface exists, exim just does not yet use it. cu andreas -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
