Re: Ask for Client Certificates

2014-02-02 Thread Patrik Båt
On lör 1 feb 2014 13:30:17, Bastian Blank wrote: > On Wed, Jan 29, 2014 at 11:39:09AM +0100, Patrik Båt wrote: >> I know this is a client problem, but have anyone seen any impact for >> enabling this? Is it a big problem now-days? > > I tried it once. The client will ask it's user for a usable >

Re: Ask for Client Certificates

2014-02-01 Thread Bastian Blank
On Wed, Jan 29, 2014 at 11:39:09AM +0100, Patrik Båt wrote: > I know this is a client problem, but have anyone seen any impact for > enabling this? Is it a big problem now-days? I tried it once. The client will ask it's user for a usable certificate. > And can you somehow explicitly set this to

Re: Ask for Client Certificates

2014-01-29 Thread Viktor Dukhovni
On Wed, Jan 29, 2014 at 03:15:44PM +0100, Patrik B?t wrote: > The problem though, is that a customer wants to send it mutual > to us (eg. mta <-> mta), but we can always setup another transport for > that and tell the customers customer to send mail to that one instead :) If they are not using

Re: Ask for Client Certificates

2014-01-29 Thread Patrik Båt
On ons 29 jan 2014 14:10:27, Wietse Venema wrote: > Patrik B?t: >> And can you somehow explicitly set this to only specified clients to >> request client certificate? > > Yes. Ask client certificates on the (mail client) submission service, > not on the (mta to mta) port 25 service. > > Wiets

Re: Ask for Client Certificates

2014-01-29 Thread Wietse Venema
Patrik B?t: > And can you somehow explicitly set this to only specified clients to > request client certificate? Yes. Ask client certificates on the (mail client) submission service, not on the (mta to mta) port 25 service. Wietse

Ask for Client Certificates

2014-01-29 Thread Patrik Båt
Hello! I have a question regarding the following (smtpd_tls_ask_ccert): Unfortunately, Netscape clients will either complain if no matching client certificate is available or will offer the user client a list of certificates to choose from. Additionally some MTAs (notably some versions of qmail)