Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

On Tue, Apr 14, 2026 at 11:47:35PM +0100, jgh via Exim-dev wrote:

> OK, if there really is a SAN then it gets more interesting.

There's a SAN, but the Subject DN is *legitimately* empty, which
is NOT the case with cumin.exim.org:

Compare:

     $ (echo "QUIT"; sleep 5) |
         openssl s_client -connect cumin.exim.org:25 -starttls smtp -showcerts |
         /opt/openssl/master/bin/openssl x509 -noout -ext subjectAltName
     Connecting to 2a00:11c0:5f:34c1::2
     depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
     verify return:1
     depth=1 C=US, O=Let's Encrypt, CN=R13
     verify return:1
---> depth=0 CN=cumin.exim.org
     verify return:1
     250 HELP
     DONE
     X509v3 Subject Alternative Name:
         DNS:cumin.exim.org, DNS:dev.exim.org, DNS:docs.exim.org, DNS:downloads.exim.org, DNS:exim.org, DNS:ftp.exim.org, DNS:git.exim.org, DNS:lists.exim.org, DNS:mta-sts.exim.org, DNS:mx.exim.org, DNS:openpgpkey.exim.org, DNS:people.exim.org, DNS:vcs.exim.org, DNS:wiki.exim.org, DNS:www.exim.org

with:

     $ (echo "QUIT"; sleep 5) |
        openssl s_client -connect pf.adam-barratt.org.uk:25 -starttls smtp -showcerts |
        /opt/openssl/master/bin/openssl x509 -noout -ext subjectAltName
     Connecting to 2a03:9800:10:246::2
     depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2
     verify return:1
     depth=2 C=US, O=ISRG, CN=Root YE
     verify return:1
     depth=1 C=US, O=Let's Encrypt, CN=YE2
     verify return:1
---> depth=0
     verify return:1
     250 HELP
     DONE
     X509v3 Subject Alternative Name: critical
         DNS:pf.adam-barratt.org.uk

The full certificate details (note the empty "Subject:" field):

    $ (echo "QUIT"; sleep 5) |
        openssl s_client -connect pf.adam-barratt.org.uk:25 -starttls smtp -showcerts |
        /opt/openssl/master/bin/openssl x509 -noout -text -certopt no_pubkey,no_sigdump
    Connecting to 188.246.206.241
    depth=3 C=US, O=Internet Security Research Group, CN=ISRG Root X2
    verify return:1
    depth=2 C=US, O=ISRG, CN=Root YE
    verify return:1
    depth=1 C=US, O=Let's Encrypt, CN=YE2
    verify return:1
    depth=0
    verify return:1
    250 HELP
    DONE
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number:
                06:3d:0f:e9:14:fe:e2:03:9e:c4:18:2d:8b:c0:6f:a0:b8:cc
            Signature Algorithm: ecdsa-with-SHA384
            Issuer: C=US, O=Let's Encrypt, CN=YE2
            Validity
                Not Before: Apr 14 13:29:48 2026 GMT
                Not After : Jul 13 13:29:47 2026 GMT
            Subject:
            X509v3 extensions:
                X509v3 Subject Alternative Name: critical
                    DNS:pf.adam-barratt.org.uk

For "cumin.exim.org" we see instead:

    $ (echo "QUIT"; sleep 5) |
        openssl s_client -connect cumin.exim.org:25 -starttls smtp -showcerts |
        /opt/openssl/master/bin/openssl x509 -noout -text -certopt no_pubkey,no_sigdump
    Connecting to 2a00:11c0:5f:34c1::2
    depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
    verify return:1
    depth=1 C=US, O=Let's Encrypt, CN=R13
    verify return:1
    depth=0 CN=cumin.exim.org
    verify return:1
    250 HELP
    DONE
    Certificate:
        Data:
            Version: 3 (0x2)
            Serial Number:
                05:54:82:19:44:2a:ec:9c:4f:12:e2:c9:96:b8:43:58:43:13
            Signature Algorithm: sha256WithRSAEncryption
            Issuer: C=US, O=Let's Encrypt, CN=R13
            Validity
                Not Before: Mar  4 07:20:06 2026 GMT
                Not After : Jun  2 07:20:05 2026 GMT
            Subject: CN=cumin.exim.org
            X509v3 extensions:
                X509v3 Subject Alternative Name:
                    DNS:cumin.exim.org, DNS:dev.exim.org, DNS:docs.exim.org, DNS:downloads.exim.org, DNS:exim.org, DNS:ftp.exim.org, DNS:git.exim.org, DNS:lists.exim.org, DNS:mta-sts.exim.org, DNS:mx.exim.org, DNS:openpgpkey.exim.org, DNS:people.exim.org, DNS:vcs.exim.org, DNS:wiki.exim.org, DNS:www.exim.org

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki