Re: [exim/exim] [Bug]: GNUTLS certificate validation incompatible with certificates lacking a commonName attribute (Issue #3215)

On 2026-04-19 Viktor Dukhovni via Exim-dev <[email protected]> wrote:
> On Sat, Apr 18, 2026 at 06:25:00PM +0200, Andreas Metzler via Exim-dev wrote:

> > In my tests gnutls_x509_crt_get_dn() returned
> > GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE for Adam's test-host instead of 0.

> > Which matches the docs:
> > https://gnutls.org/reference/gnutls-x509.html#gnutls-x509-crt-get-dn

> The documentation is also in a state of sin, describing a fictional
> situation in which "the DN does not exist", as opposed to "the DN
> is an empty sequence".

Good morning,
The obvious change would be
diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index a55389b344..b2251d68f4 100644
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -1061,3 +1061,3 @@ int gnutls_x509_crt_get_issuer_dn_oid(gnutls_x509_crt_t cert, unsigned indx,
  *   with the required size. %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE if
- *   the DN does not exist, or another error value on error. On success 0 is returned.
+ *   the DN is an empty sequence, or another error value on error. On success 0 is returned.

"empty sequence" just seems to be superverbose without adding value over
"empty".


> In your tests, did you pass a NULL for the
> output buffer and a pointer to a size that was initialised to 0?

Yes. I basically added a printf after the invocation in Jeremy's possible
fix:
sz=0
...
if ((rc = gnutls_x509_crt_get_dn(crt, NULL, &sz)))


cu Andreas