Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)
Viktor Dukhovni via Exim-dev <[email protected]> Tue, 14 Apr 2026 20:22:09 +1000
| Newsgroups | gmane.mail.exim.devel |
|---|---|
| Message-ID | <[email protected]> |
On Mon, Apr 13, 2026 at 07:43:22PM +0100, adsbarratt via Exim-dev wrote:
> Seen using Exim 4.96-15+deb12u7 on Debian 12, but the relevant code
> does not appear to have changed in the meantime
Is the Exim build in quetion definitely linked with GnuTLS and not
OpenSSL? If you want to have working DANE support in Exim, you should
IMNSHO avoid the GnuTLS backend.
> After some investigation, the common factor appears to be that the
> certificate provided by the destination server is lacking a commonName
> attribute. This causes verify_certificate() to return e.g.:
This should work with the OpenSSL backend.
--
Viktor. 🇺🇦 Слава Україні!
--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
## [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki