Ralf Hildebrandt:
> (Not my question, but since Victor doesn't do offlist mails...)
Victor is not on the list in August.
> I am interested to learn how multiple x.509 certificates/hostnames are
> supported by postfix.
The Postfix SMTP client supports one server certificate per
connection:
Another area where RFCs aren't always explicit is the handling
of dNSNames in peer certificates. RFC 3207 (SMTP over TLS)
does not mention dNSNames. Postfix follows the strict rules
in RFC 2818 (HTTP over TLS), section 3.1: The Subject
Alternative Name/dNSName has precedence over CommonName. If
at least one dNSName is provided, Postfix verifies those
against the peer hostname and ignores the CommonName, otherwise
Postfix verifies the CommonName against the peer hostname.
> Patrick suggested you can use SubjectAlternativeName to have multiple
> hostnames, which is ok if you self-generate certificates.
>
> I wonder if there is a way to integrate SNI with STARTTLS. It might be a
> problem because the localpart @domain.tld is only known after the rcpt-to
> line is given. SNI should allow multiple certificate files.
As far as I know, the Postfix SMTP server does not care about names
in client certificates.
Wietse
