Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

OK, if there really is a SAN then it gets more interesting.

Running up a test against exim.org primary MX:

23:20:21 203922   SMTP>> STARTTLS
23:20:21 203922 cmd buf flush 10 bytes
23:20:21 203922 read response data: size=18
23:20:21 203922   SMTP<< 220 TLS go ahead
23:20:21 203922 152.53.204.32 in hosts_require_ocsp? no (option unset)
23:20:21 203922 152.53.204.32 in hosts_request_ocsp?
23:20:21 203922  list element: *
23:20:21 203922  152.53.204.32 in hosts_request_ocsp? yes (matched "*")
23:20:21 203922 initialising GnuTLS as a client on fd 18
23:20:21 203922 GnuTLS global init required
23:20:21 203922 initialising GnuTLS client session
23:20:21 203922 Expanding various TLS configuration options for session credentials
23:20:21 203922 TLS: basic cred init, client
23:20:21 203922 TLS: no client certificate specified; okay
23:20:21 203922 GnuTLS<2>: Initializing needed PKCS #11 modules
23:20:21 203922 GnuTLS<2>: p11: Initializing module: p11-kit-trust
23:20:21 203922 GnuTLS<2>: p11: Module p11-kit-trust is initialized in a thread-safe mode
23:20:21 203922 GnuTLS<2>: p11: No login requested.
23:20:21 203922 GnuTLS<3>: p11 attrs: CKA_CLASS (CERT), CKA_CERTIFICATE_TYPE
23:20:21 203922 GnuTLS<3>: p11 attrs: CKA_TRUSTED
23:20:21 203922 GnuTLS<3>: p11 attrs: CKA_CERTIFICATE_CATEGORY=CA
23:20:21 203922 GnuTLS<2>: p11: No login requested.
23:20:21 203922 GnuTLS<3>: p11 attrs: CKA_CLASS (CERT), CKA_CERTIFICATE_TYPE
23:20:21 203922 GnuTLS<3>: p11 attrs: CKA_TRUSTED
23:20:21 203922 GnuTLS<3>: p11 attrs: CKA_CERTIFICATE_CATEGORY=CA
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/pkcs11.c[find_multi_objs_cb]:3173
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/pkcs11.c[gnutls_pkcs11_obj_list_import_url3]:3484
23:20:22 203922 Added 388 certificate authorities
23:20:22 203922 GnuTLS using default session cipher/priority "NORMAL"
23:20:22 203922 GnuTLS<2>: added 6 protocols, 29 ciphersuites, 22 sig algos and 10 groups into priority list
23:20:22 203922 Setting D-H prime minimum acceptable bits to 1024
23:20:22 203922 152.53.204.32 in tls_verify_hosts? no (option unset)
23:20:22 203922 152.53.204.32 in tls_try_verify_hosts?
23:20:22 203922  list element: *
23:20:22 203922  152.53.204.32 in tls_try_verify_hosts? yes (matched "*")
23:20:22 203922 152.53.204.32 in tls_verify_cert_hostnames?
23:20:22 203922  list element: *
23:20:22 203922  152.53.204.32 in tls_verify_cert_hostnames? yes (matched "*")
23:20:22 203922 TLS: server cert verification includes hostname: "cumin.exim.org"
23:20:22 203922 TLS: server certificate verification optional
23:20:22 203922 TLS: will request OCSP stapling
23:20:22 203922 152.53.204.32 in tls_resumption_hosts? no (option unset)
23:20:22 203922 no resumption for this host
23:20:22 203922 about to gnutls_handshake
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 13.02 (GNUTLS_AES_256_GCM_SHA384)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 13.03 (GNUTLS_CHACHA20_POLY1305_SHA256)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 13.01 (GNUTLS_AES_128_GCM_SHA256)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 13.04 (GNUTLS_AES_128_CCM_SHA256)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.2c (GNUTLS_ECDHE_ECDSA_AES_256_GCM_SHA384)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite cc.a9 (GNUTLS_ECDHE_ECDSA_CHACHA20_POLY1305)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.ad (GNUTLS_ECDHE_ECDSA_AES_256_CCM)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.0a (GNUTLS_ECDHE_ECDSA_AES_256_CBC_SHA1)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.2b (GNUTLS_ECDHE_ECDSA_AES_128_GCM_SHA256)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.ac (GNUTLS_ECDHE_ECDSA_AES_128_CCM)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.09 (GNUTLS_ECDHE_ECDSA_AES_128_CBC_SHA1)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.30 (GNUTLS_ECDHE_RSA_AES_256_GCM_SHA384)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite cc.a8 (GNUTLS_ECDHE_RSA_CHACHA20_POLY1305)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.14 (GNUTLS_ECDHE_RSA_AES_256_CBC_SHA1)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.2f (GNUTLS_ECDHE_RSA_AES_128_GCM_SHA256)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.13 (GNUTLS_ECDHE_RSA_AES_128_CBC_SHA1)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 00.9d (GNUTLS_RSA_AES_256_GCM_SHA384)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.9d (GNUTLS_RSA_AES_256_CCM)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 00.35 (GNUTLS_RSA_AES_256_CBC_SHA1)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 00.9c (GNUTLS_RSA_AES_128_GCM_SHA256)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.9c (GNUTLS_RSA_AES_128_CCM)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 00.2f (GNUTLS_RSA_AES_128_CBC_SHA1)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 00.9f (GNUTLS_DHE_RSA_AES_256_GCM_SHA384)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite cc.aa (GNUTLS_DHE_RSA_CHACHA20_POLY1305)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.9f (GNUTLS_DHE_RSA_AES_256_CCM)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 00.39 (GNUTLS_DHE_RSA_AES_256_CBC_SHA1)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 00.9e (GNUTLS_DHE_RSA_AES_128_GCM_SHA256)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite c0.9e (GNUTLS_DHE_RSA_AES_128_CCM)
23:20:22 203922 GnuTLS<2>: Keeping ciphersuite 00.33 (GNUTLS_DHE_RSA_AES_128_CBC_SHA1)
23:20:22 203922 GnuTLS<2>: Advertizing version 3.4
23:20:22 203922 GnuTLS<2>: Advertizing version 3.3
23:20:22 203922 GnuTLS<2>: Advertizing version 3.2
23:20:22 203922 GnuTLS<2>: Advertizing version 3.1
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[get_last_packet]:1138
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[get_last_packet]:1130
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[_gnutls_handshake_io_recv_int]:1374
23:20:22 203922 GnuTLS<2>: EXT[0x555c15fceda0]: client generated SECP256R1 shared key
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[get_last_packet]:1138
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[get_last_packet]:1138
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[get_last_packet]:1130
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[_gnutls_handshake_io_recv_int]:1374
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[get_last_packet]:1138
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/buffers.c[get_last_packet]:1138
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/constate.c[_gnutls_epoch_get]:971
23:20:22 203922 (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
23:20:22 203922 To get keying info for TLS1.3 is hard:
23:20:22 203922  Set environment variable SSLKEYLOGFILE to a filename relative to the spool directory,
23:20:22 203922  and make sure it is writable by the Exim runtime user.
23:20:22 203922  Add SSLKEYLOGFILE to keep_environment in the exim config.
23:20:22 203922  Start Exim as root.
23:20:22 203922  If using sudo, add SSLKEYLOGFILE to env_keep in /etc/sudoers
23:20:22 203922  (works for TLS1.2 also, and saves cut-paste into file).
23:20:22 203922  Trying to use add_environment for this will not work
23:20:22 203922 TLS: checking peer certificate
23:20:22 203922 GnuTLS<3>: ASSERT: ../../../lib/x509/dn.c[_gnutls_x509_parse_dn]:282
...
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/pkcs11.c[_gnutls_pkcs11_crt_is_known]:4717
23:20:22 203922 GnuTLS<2>: crt_is_known: did not find any cert
23:20:22 203922 GnuTLS<3>: ASSERT: ../../../lib/x509/name_constraints.c[gnutls_x509_crt_get_name_constraints]:1041
23:20:22 203922 GnuTLS<3>: ASSERT: ../../../lib/x509/name_constraints.c[gnutls_x509_crt_get_name_constraints]:1041
23:20:22 203922 TLS certificate verified: peerdn="CN=cumin.exim.org"
23:20:22 203922 GnuTLS<3>: ASSERT: ../../lib/ocsp-api.c[gnutls_ocsp_status_request_get2]:96
23:20:22 203922 cipher: TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256:SECP256R1
23:20:22 203922 Have channel bindings cached for possible auth usage
23:20:22 203922   SMTP>> EHLO jgh.test

That system seems to have a similar cert:

0 s:CN=cumin.exim.org
  i:C=US, O=Let's Encrypt, CN=R13
  a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
  v:NotBefore: Mar  4 07:20:06 2026 GMT; NotAfter: Jun  2 07:20:05 2026 GMT

and

X509v3 Subject Alternative Name: 
   DNS:cumin.exim.org, DNS:dev.exim.org, DNS:docs.exim.org, DNS:downloads.exim.org, DNS:exim.org, DNS:ftp.exim.org, DNS:git.exim.org, DNS:lists.exim.org, DNS:mta-sts.exim.org, DNS:mx.exim.org, DNS:openpgpkey.exim.org, DNS:people.exim.org, DNS:vcs.exim.org, DNS:wiki.exim.org, DNS:www.exim.org

apart from being an RSA (eek, 4096!) rather than EC. I don't know if that point could account for this issue; are you in position to deploy an RSA as a test?

---
View it on Exim Forgejo ( https://code.exim.org/exim/exim/issues/3215#issuecomment-239519 ) or reply to this email directly.