Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

Apologies for the missing information. The initial case that I observed was for a user of a service that I don't manage, just provide mail service for, so I wasn't comfortable providing the precise details. The mail had also already disappeared before I could do much debugging.

I've now set up a test environment that can be used to demonstrate the issue. The server at pf.adam-barratt.org.uk is using a certificate that has an empty Subject: field (acquired earlier today from LetsEncrypt using the "tlsserver" ACME profile), whereas baloo.adam-barratt.org.uk uses a more "traditional" certificate.

The original failure was DANE-related, but for reproduction it was sufficient to add the following to the outbound SMTP transport:

tls_tempfail_tryclear = false
hosts_require_tls = pf.adam-barratt.org.uk : baloo.adam-barratt.org.uk
tls_verify_hosts = pf.adam-barratt.org.uk : baloo.adam-barratt.org.uk

Delivering to the server at "pf" fails:

16:02:59 702757 gethostbyname2 looked up these IP addresses:
16:02:59 702757   name=pf.adam-barratt.org.uk address=2a03:9800:10:246::2
16:02:59 702757   name=pf.adam-barratt.org.uk address=188.246.206.241
16:02:59 702757 2a03:9800:10:246::2 in tls_verify_hosts? yes (matched "pf.adam-barratt.org.uk")
16:02:59 702757 2a03:9800:10:246::2 in tls_verify_cert_hostnames? yes (matched "*")
16:02:59 702757 TLS: server cert verification includes hostname: "pf.adam-barratt.org.uk"
16:02:59 702757 TLS: server certificate verification required
16:02:59 702757 TLS: will request OCSP stapling
16:02:59 702757 2a03:9800:10:246::2 in tls_resumption_hosts? no (option unset)
16:02:59 702757 about to gnutls_handshake
16:02:59 702757 (TLS1.3)-(ECDHE-SECP256R1)-(ECDSA-SECP384R1-SHA384)-(AES-256-GCM)
16:02:59 702757 To get keying info for TLS1.3 is hard:
16:02:59 702757  Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,
16:02:59 702757  and make sure it is writable by the Exim runtime user.
16:02:59 702757  Add SSLKEYLOGFILE to keep_environment in the exim config.
16:02:59 702757  Start Exim as root.
16:02:59 702757  If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers
16:02:59 702757  (works for TLS1.2 also, and saves cut-paste into file).
16:02:59 702757  Trying to use add_environment for this will not work
16:02:59 702757 TLS: checking peer certificate
16:02:59 702757 TLS: peer cert problem: getting size for cert DN failed: The requested data were not available.
16:02:59 702757 TLS certificate verification failed (certificate not supplied): peerdn="<unset>"
16:02:59 702757 TLS session fail: (certificate verification failed): certificate not supplied
16:02:59 702757   SMTP(close)>>
16:02:59 702757 cmdlog: '220:EHLO:250-:STARTTLS:220'
16:02:59 702757 set_process_info: 702757 delivering 1wCfI2-002woi-2Z: just tried pf.adam-barratt.org.uk [2a03:9800:10:246::2] for [email protected]: result DEFER
16:02:59 702757 added retry item for T:pf.adam-barratt.org.uk:2a03:9800:10:246::2: errno=-37 more_errno=0,A flags=2

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3215#issuecomment-239514 ) or reply to this email directly.