Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

You are configured to require that the server cert has a hostname which matches the peer you are talking to:

16:02:59 702757 2a03:9800:10:246::2 in tls_verify_cert_hostnames? yes (matched "*")

The server cert seemingly has no name, neither SN nor SAN:

0 s:                              
  i:C = US, O = Let's Encrypt, CN = YE2
  a:PKEY: id-ecPublicKey, 384 (bit); sigalg: ecdsa-with-SHA384
  v:NotBefore: Apr 14 13:29:48 2026 GMT; NotAfter: Jul 13 13:29:47 2026 GMT

Anybody could supply that cert; it will provide no assurance that you are talking to the peer you wanted to talk to, should you cease requiring the verification of hostname. You could, and happily be protected from casual third-party snooping by the TLS encryption; that will still work.

Or you could obtain a leaf cert for "pf" that has a SAN.

So far, this does not appear to be a bug.

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3215#issuecomment-239517 ) or reply to this email directly.