[exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

What is the problem environment ?
---------------------------------

Seen using Exim 4.96-15+deb12u7 on Debian 12, but the relevant code does not appear to have changed in the meantime

What happened?
--------------

We discovered that TLS connections to some hosts were failing.

After some investigation, the common factor appears to be that the certificate provided by the destination server is lacking a commonName attribute. This causes verify_certificate() to return e.g.:

DANE attempt failed; TLS connection to [HOST]: (certificate verification failed): certificate not supplied

Such certificates may be generated by e.g. the use of LetsEncrypt's "tlsserver" profile - https://letsencrypt.org/docs/profiles/#tlsserver

The CAB Forum now recommends not including commonName, as per https://github.com/cabforum/servercert/blob/main/docs/BR.md#71272-domain-validated

Relevant log output
-------------------

No response

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3215 ) or reply to this email directly.