SNI on STARTTLS in mailfront

The IETF recently defined RFC 8461, which defines a spec called MTA-STS 
which lets you publish mail security policies like "all of my mail servers 
do STARTTLS and these are their names."

An MTA need not have only one name, and it's fairly common for every 
domain assigned to one to have its own name, e.g. for foo.com it's 
mx.foo.com.  This makes MTA-STS harder, because the TLS certificate the 
server presents has to match the name the client expects.  Fortunately 
there is a hack called SNI, invented for multiple web sites sitting on a 
single IP, that lets the client tell the server what name it expects.

As part of my MTA-STS hackery I added SNI to the mailfront starttls code. 
There's a new environment variable TLS_CERTDIR which is where the 
directories with the SNI certs are.  You do have to generate and sign the 
certs, but with Let's Encrypt that's not too hard.

If anyone else wants it, let me know.  It's not a big deal.  I added 90 
lines to the existing 223 in starttls-gnutls.c, which includes checking 
for error conditions I forgot to check before.

Regards,
John Levine, [email protected], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly