Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

Certificate details:

adam@adsbarratt:~$ (echo "QUIT"; sleep 5) | openssl s_client -connect pf.adam-barratt.org.uk:25 -starttls smtp
CONNECTED(00000003)                                                                                      
depth=3 C = US, O = Internet Security Research Group, CN = ISRG Root X2
verify return:1                                                                                          
depth=2 C = US, O = ISRG, CN = Root YE                                                                   
verify return:1                                                                                          
depth=1 C = US, O = Let's Encrypt, CN = YE2                                                              
verify return:1                         
depth=0                  
verify return:1
---                                       
Certificate chain
0 s:                              
  i:C = US, O = Let's Encrypt, CN = YE2
  a:PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384
  v:NotBefore: Apr 14 13:29:48 2026 GMT; NotAfter: Jul 13 13:29:47 2026 GMT
1 s:C = US, O = Let's Encrypt, CN = YE2
  i:C = US, O = ISRG, CN = Root YE                                                                      
  a:PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384
  v:NotBefore: Sep  3 00:00:00 2025 GMT; NotAfter: Sep  2 23:59:59 2028 GMT
2 s:C = US, O = ISRG, CN = Root YE           
  i:C = US, O = Internet Security Research Group, CN = ISRG Root X2
  a:PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384
  v:NotBefore: Sep  3 00:00:00 2025 GMT; NotAfter: Sep  2 23:59:59 2032 GMT
3 s:C = US, O = Internet Security Research Group, CN = ISRG Root X2
  i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
  a:PKEY: id-ecPublicKey, 384 (bit); sigalg: RSA-SHA256
  v:NotBefore: Sep  3 00:00:00 2025 GMT; NotAfter: Sep  2 23:59:59 2032 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDejCCAwCgAwIBAgISBj0P6RT+4gOexBgti8BvoLjMMAoGCCqGSM49BAMDMDMx
CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQDEwNZ
RTIwHhcNMjYwNDE0MTMyOTQ4WhcNMjYwNzEzMTMyOTQ3WjAAMHYwEAYHKoZIzj0C
AQYFK4EEACIDYgAEiqgTHBI/V/ClyWmqT9yDn0lDQK3X+Vv5SO7t5D6OOsTC6uGN
9dMIiYxes2wwxVg+2lPpjaY9W74nHrNVDVkJR8iPDD6LoEk2t3BcwjmInxC5RRn+
rXmu/UMvpLDg1H8lo4ICCDCCAgQwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoG
CCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUuVnyjs8i8IbTN0j/
dhQYuoLYVYcwMwYIKwYBBQUHAQEEJzAlMCMGCCsGAQUFBzAChhdodHRwOi8veWUy
LmkubGVuY3Iub3JnLzAkBgNVHREBAf8EGjAYghZwZi5hZGFtLWJhcnJhdHQub3Jn
LnVrMBMGA1UdIAQMMAowCAYGZ4EMAQIBMC4GA1UdHwQnMCUwI6AhoB+GHWh0dHA6
Ly95ZTIuYy5sZW5jci5vcmcvNzcuY3JsMIIBDAYKKwYBBAHWeQIEAgSB/QSB+gD4
AHcA2AlVO5RPev/IFhlvlE+Fq7D4/F6HVSYPFdEucrtFSxQAAAGdjGSjcwAABAMA
SDBGAiEAt5p2DArHCAk0R02yVHR2bNfgEE6Jd4X9OW+xB6gHmFkCIQDtk8IZCh3G
/EXOArXyt7/NVLA7TWgDUFxAN2zHlaYU1wB9AGz+UBlDqF6pFrxS0TPk3Mke8UEc
fSWEINFzgJ4YGOs6AAABnYxkpE8ACAAABQAHLsxOBAMARjBEAiAXZeOiP4oREB8n
amc5X1XlWP5zUXQJ+FHmu4Xq6qCJtQIgJ5FuQpVdCNwuTiTCPGNB/jhmFPNZ/UGE
AgUOwhA8pCQwCgYIKoZIzj0EAwMDaAAwZQIwO3Vj8INQ9SafRUImFqIR6PykzzFf
PvjljIQNGykZ1z+14/vC5T0JaEILPFRNf9vwAjEA9nIcCl7i03ElPPW7soF/E3LV
i4LOkfllZ+x8aHaJ+Af3dF3JctqpSS5aPUjoMOu7
-----END CERTIFICATE-----
subject=
issuer=C = US, O = Let's Encrypt, CN = YE2
---
No client certificate CA names sent
Peer signing digest: SHA384
Peer signature type: ECDSA
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4031 bytes and written 441 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 384 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
250 HELP
DONE

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3215#issuecomment-239516 ) or reply to this email directly.