Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

On Wed, Apr 15, 2026 at 10:30:46AM +0200, Andreas Metzler via Exim-dev wrote:
> On 2026-04-14 adsbarratt via Exim-dev <[email protected]> wrote:
> [...]
> > 16:02:59 702757 TLS: checking peer certificate
> > 16:02:59 702757 TLS: peer cert problem: getting size for cert DN failed: The requested data were not available.
> [...]
> 
> That is
> sz = 0;
> rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
> if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
>   {
>   exim_gnutls_peer_err(US"getting size for cert DN failed");
>   return FAIL; /* should not happen */
>   }
> 
> Which does happen if there is no Subject.

That test is not ideal, because when the subject is empty, the NULL
buffer with a size of 0 is NOT too short. :-)  So it likely returns `0`
(Success), which should be accepted as a valid (empty) DN.

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
## subscription configuration (requires account):
##   https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
##   [email protected]
## Exim details at https://www.exim.org/
## Please use the Wiki with this list - https://code.exim.org/exim/wiki/wiki