Re: SNI on STARTTLS in mailfront

On 2019-01-30 12:10, Giam Teck Choon wrote:
Hi John,

> On 2019-01-30 12:03, John Levine wrote:
>> On Wed, 30 Jan 2019, Giam Teck Choon wrote:
>>>> If anyone else wants it, let me know.  It's not a big deal.  I added
>>>> 90 lines to the existing 223 in starttls-gnutls.c, which includes
>>>> checking for error conditions I forgot to check before.
>>> 
>>> I want it please.
>> 
>> Here it is, updated starttls-gnutls.c
> 
> Got it. Thanks a lot.

I used your starttls-gnutls.c and encountered problems when TLS_CERTDIR 
is set and regardless SNI cert/key file exists will show the following 
errors:

The below error suppose to use the default TLS_CERTFILE and TLS_KEYFILE 
when SNI cert/key files not found:

@400000005c5bdf89185de07c mailfront[20072]: Starting TLS handshake
@400000005c5bdf89185df7ec mailfront[20072]: No SNI in request, using 
default certificate
@400000005c5bdf89185dffbc mailfront[20072]: TLS handshake failed: Could 
not negotiate a supported cipher suite.

The below error suppose to use the SNI cert/key files (when exists) when 
TLS_CERTDIR is set. I patched your starttls-gnutls.c to show the SNI 
key/cert files:

@400000005c5bdf91377adf8c mailfront[20075]: Starting TLS handshake
@400000005c5bdf9137d23ad4 mailfront[20075]: Using SNI cert/key file for 
rat.choon.net
@400000005c5bdf9137d24a74 mailfront[20075]: SNI certfile 
/var/qmail/ssl/rat.choon.net/rat.choon.net.crt for rat.choon.net
@400000005c5bdf9137d25244 mailfront[20075]: SNI keyfile 
/var/qmail/ssl/rat.choon.net/rat.choon.net.key for rat.choon.net
@400000005c5bdf9137d25a14 mailfront[20075]: TLS handshake failed: Could 
not negotiate a supported cipher suite.

If TLS_CERTDIR not set then everything working to use TLS_CERTFILE and 
TLS_KEYFILE.

System is CentOS 7. openssl version/release is 1.0.2k-16.el7 and gnutls 
version/release is 3.3.29-8.el7.

Thanks for file and any suggestions I can get to make SNI work in my 
system.

Kindest regards,
Giam Teck Choon