Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

On 2026-04-15 jgh via Exim-dev <[email protected]> wrote:
> Good to hear it's not the EC-ness.

> So, this might work as a patch. I don't know yet if there will be follow-on effects from the lack of DN though.

> diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c
> index 5c840edc5..c29395ac7 100644
> --- a/src/src/tls-gnu.c
> +++ b/src/src/tls-gnu.c
> @@ -2517,17 +2517,24 @@ exim_gnutls_peer_err(US"cert 0");
> state->tlsp->peercert = state->peercert = crt;

> sz = 0;
> -rc = gnutls_x509_crt_get_dn(crt, NULL, &sz);
> -if (rc != GNUTLS_E_SHORT_MEMORY_BUFFER)
> +if ((rc = gnutls_x509_crt_get_dn(crt, NULL, &sz)))
[...]

Hello,

In my tests gnutls_x509_crt_get_dn() returned
GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE for Adam's test-host instead of 0.
Which matches the docs:
https://gnutls.org/reference/gnutls-x509.html#gnutls-x509-crt-get-dn

| Returns
| 
| GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough,
| and in that case the buf_size will be updated with the required size.
| GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if the DN does not exist, or
| another error value on error. On success 0 is returned.

cu Andreas
-- 
"You people are noisy," Nia said.
I made the gesture of agreement.