Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

On Tue, Apr 14, 2026 at 06:03:46PM +0100, jgh via Exim-dev wrote:

> You are configured to require that the server cert has a hostname
> which matches the peer you are talking to:

That is, the DNS-ID SAN.

> The server cert seemingly has no name, neither SN nor SAN:

That's not the case, it has a DNS-ID SAN:

    $ (echo "QUIT"; sleep 5) |
        openssl s_client -connect pf.adam-barratt.org.uk:25 -starttls smtp -showcerts |
        /opt/openssl/master/bin/openssl x509 -noout -ext subjectAltName
    Connecting to 188.246.206.241
    depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2
    verify return:1
    depth=2 C=US, O=ISRG, CN=Root YE
    verify return:1
    depth=1 C=US, O=Let's Encrypt, CN=YE2
    verify return:1
    depth=0
    verify return:1
    250 HELP
    DONE
    X509v3 Subject Alternative Name: critical
        DNS:pf.adam-barratt.org.uk

And so, with OpenSSL as the backend (apologies for giving a Postfix
example, I use the tools I'm most familiar with):

    $ posttls-finger -c -Lcertmatch,summary -lsecure -F/etc/pki/tls/cert.pem "[pf.adam-barratt.org.uk]"
    posttls-finger: pf.adam-barratt.org.uk[2a03:9800:10:246::2]:25: matched peername: pf.adam-barratt.org.uk
    posttls-finger: pf.adam-barratt.org.uk[2a03:9800:10:246::2]:25: subject_CN=pf.adam-barratt.org.uk, issuer=YE2, cert fingerprint=..., pkey fingerprint=...
    posttls-finger: Verified TLS connection established to pf.adam-barratt.org.uk[2a03:9800:10:246::2]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki